Threat database

CVE-2026-105040 is a high-severity authorization bypass vulnerability in the EnergizeLab NestJS auth service version 1.8.2. It allows a registered user to manipulate the user ID in account update requests, enabling them to take over other user accounts by setting another account's identifier.

EnergizeLab station-middleware versions 1.6.5 through 1.8.2 contain a missing authorization vulnerability in administrative APIs. Authenticated users with low privileges can access sensitive operations such as retrieving AI provider keys and modifying configuration and object-store contents. This vulnerability allows unauthorized privilege escalation and data exposure.

CVE-2026-105038 is a critical vulnerability in the EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services. These services expose AI model administration functions without requiring authentication, allowing unauthenticated remote attackers to change AI model configurations and switch the model in use at runtime. The vulnerability has a CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-105037 is a critical vulnerability in EnergizeLab station-middleware (NestJS) Docker images versions 1.6.5 through 1.8.2. It allows any registered user with low privileges to read arbitrary files on the server by supplying a malicious file path. This flaw exposes sensitive middleware files and server secrets, potentially leading to full compromise of confidentiality, integrity, and availability.

EnergizeLab Robot firmware (mode 104000), including the AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and EnergizeLab Windows desktop app 3.1.2, download firmware updates over unencrypted HTTP without verifying their integrity or authenticity. This allows an attacker who can intercept or modify network traffic to substitute malicious firmware updates.

CVE-2026-105035 is a high-severity vulnerability in the EnergizeLab FirmwareUpdater where a hard-coded AES cryptographic key is used across all installations. This flaw allows an attacker who obtains the key to decrypt and forge firmware packages for any device trusting the updater, compromising confidentiality, integrity, and availability.

CVE-2026-105034 is a high-severity vulnerability in the EnergizeLab NestJS auth service version 1.8.2. The service issues device tokens for arbitrary robot serial numbers without requiring authentication, allowing unauthenticated remote attackers to obtain valid device tokens and impersonate devices against cloud services.

The EnergizeLab AI Station (RK3562) firmware contains a vulnerability due to hard-coded default root credentials with SSH enabled. This allows an attacker with network access to log in as root and gain full control of the device. The vulnerability has a high severity score of 8.8 and affects the firmware image as shipped. No specific affected versions or patches are provided in the available data.

CVE-2026-105032 is a critical vulnerability in the EnergizeLab FastAPI AI inference server used by Eilik and EilikO robots. The AI skill upload endpoint lacks authentication and does not restrict file paths, allowing unauthenticated remote attackers to perform path traversal and write arbitrary files. This enables tampering with AI skill files, potentially impacting the integrity and availability of the AI services.