AL‑KO Robolinho Update Software contains hard‑coded AWS Access and Secret keys within its binaries, enabling anyone who obtains the software to authenticate to the vendor’s Amazon Web Services bucket and read the stored objects. The embedded credentials may also grant higher privileges than the application’s intended scope, potentially giving attackers broader access to the AWS account. This weakness maps to CWE‑798, the improper hard‑coding of credentials.

Versions 8.0.21.0610 and 8.0.22.0524 have been confirmed to contain the hard‑coded keys. No additional versions were tested; the vendor has not disclosed a specific vulnerable version range, so earlier or later releases may also be affected.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, implying no known live exploits. Attackers could extract the hard‑coded keys from the binary or installation files, then use these credentials to authenticate to the AWS bucket, obtaining read access to stored objects and possibly higher privileges if the keys exceed the application’s intended permissions.