The EnergizeLab Eilik NestJS authentication module allows an attacker who needs no credentials to generate a device token for any robot by supplying only its serial number. This flaw gives the attacker a bearer token accepted by the cloud services, effectively granting the same level of access as an authenticated device. The attacker can then send commands, read or alter data, and potentially manipulate the robot’s behavior. This vulnerability corresponds to CWE-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function).

The affected product is EnergizeLab's NestJS based authentication service used in the Eilik robot platform. The vulnerability affects all versions of the service that have not applied the vendor’s remediation, as the CNA did not specify version ranges in the data. It is important to verify whether your deployment uses the public or custom instance of the NestJS auth service.

The CVSS score of 8.2 indicates a high severity potential. Because the attack is remote and requires no special access privileges, the likelihood of exploitation is significant, though the EPSS score is not available. The flaw is not listed in the CISA KEV catalog. An attacker can simply send an unauthenticated request with a guessed or known serial number and obtain a token, after which all subsequent actions are permitted. Compromise likely extends to confidentiality, integrity, and availability concerns for the robot and its data.