Description
EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a malicious update.
Published: 2026-10-15
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Potential Firmware Compromise (remote code execution)
Action: Immediate Patch
AI Analysis

Impact

EnergizeLab AI Station firmware, EilikO robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3. updates over plain HTTP without verifying integrity or authenticity. The lack of authentication means an attacker able to intercept or tamper with the traffic can substitute a malicious update, leading to arbitrary code execution or other compromises on the affected device. The weakness is a failure to check provenance and integrity of downloaded content (CWE-494).

Affected Systems

The affected products are EnergizeLab AI Station firmware for the RK3562 platform, EnergizeLab Robot firmware (mode 104000) v2.1_20260617182218_release, and the EnergizeLab Windows desktop application EnergizeLabSetup-3.1.2-Win.exe. All versions currently rely on HTTP for firmware or application updates, and no specific patched versions were enumerated in the source data.

Risk and Exploitability

The CVSS score of 7.5 indicates a moderate‑to‑high severity. Although the EPSS score is not provided, the absence of a KEV listing does not negate potential exploitation, especially given the vulnerability’s remote nature: an adversary with network access can perform a man‑in‑the‑middle attack to deliver a counterfeit update. The impact can span from compromising individual devices to undermining operational integrity of a fleet if not mitigated.

Generated by OpenCVE AI on October 16, 2026 at 11:53 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update all EnergizeLab products to the latest release that employs HTTPS for firmware downloads and validates integrity.
  • Reconfigure devices or the network to block plain HTTP traffic to the firmware update servers and enforce encryption or deploy an inspection system that rejects unverified updates.
  • If a patch is not yet available, manually verify downloaded firmware or installer artifacts against vendor‑supplied checksums or digital signatures before installing, and avoid using the default HTTP update path.

Generated by OpenCVE AI on October 16, 2026 at 11:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
Description EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a malicious update.
Title EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks
Weaknesses CWE-494
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: AHA

Published:

Updated: 2026-10-16T19:53:00.841Z

Reserved: 2026-10-02T21:30:55.242Z

Link: CVE-2026-105036

cve-icon Vulnrichment

Updated: 2026-10-16T19:52:50.669Z

cve-icon NVD

Status : Deferred

Published: 2026-10-15T21:17:04.230

Modified: 2026-10-16T20:17:18.217

Link: CVE-2026-105036

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T13:53:29Z

Weaknesses
  • CWE-494

    Download of Code Without Integrity Check