The FirmwareUpdater binary for EnergizeLab devices contains a single hard‑coded AES key that is used to decrypt firmware images. Because the same key is embedded in every copy of the updater, an adversary who recovers the key can decrypt any signed firmware package and then reencrypt a modified image using the same key. This enables the attacker to supply forged firmware that will be accepted as legitimate by the device, effectively subverting the update mechanism and allowing arbitrary code execution, data exfiltration or sabotage of device functionality.

All installations of EnergizeLab FirmwareUpdater that run the AArch64 ELF binary compiled into the CDN bin.zip file are affected. Since the key is baked into the binary, all releases that ship that binary share the vulnerability; no version differentiation is specified, so any device that receives updates from this updater is at risk.

The vulnerability carries a CVSS base score of 7.8, classifying it as high severity. The EPSS score is not available, but the fact that the key can be extracted from a publicly distributed binary lowers the barrier to exploitation; an attacker with access to the binary or remote/network control can recover the key, produce valid firmware images and push them to any device that trusts the updater. The vulnerability is not currently listed in the CISA KEV catalog, yet the universal key exposes every device that relies on this updater to compromise with minimal effort. The likely attack path involves reverse‑engineering the updater to locate the hard‑coded key, then forging firmware images for deployment.