High severity7.8NVD Advisory· Published Oct 15, 2026

CVE-2026-105035

Description

The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

EnergizeLab/FirmwareUpdaterllm-create

Patches

Vulnerability mechanics

References

takeonme.org/gcves/GCVE-1337-2026-00000000000000000001111111111100000000000000000000000011111111100111111111000000000000000000011111111111111100000000000000000001111/nvd
www.theverge.com/tech/1010727/eiliko-robot-hack-energize-labnvd

News mentions

No linked articles in our index yet.

cvss	0.507
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000