Energizelab
9 CVEs in 7 Energizelab products, including Ai Station Firmware (Rk3562), Fastapi Ai Inference Server, Nestjs Auth Service.
Energizelab products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-105040 | High | 8.8 | 2026-10-15 | The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another acc… |
CVE-2026-105039 | Critical | 9.6 | 2026-10-15 | EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user… |
CVE-2026-105038 | Critical | 9.8 | 2026-10-15 | The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticate… |
CVE-2026-105037 | Critical | 9.9 | 2026-10-15 | EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server b… |
CVE-2026-105036 | High | 7.5 | 2026-10-15 | EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updat… |
CVE-2026-105035 | High | 7.8 | 2026-10-15 | The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who rec… |
CVE-2026-105034 | High | 8.2 | 2026-10-15 | The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker ca… |
CVE-2026-105033 | High | 8.8 | 2026-10-15 | The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log i… |
CVE-2026-105032 | Critical | 9.1 | 2026-10-15 | The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does… |