CVE-2026-105034CWE-287CWE-306

CVE-2026-105034

High · published October 16, 2026

CVSS v3.1
8.2
EPSS
1%
Percentile
45.8
In the wild
Unconfirmed
What it is

The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00558 · 45.8th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-306 · Missing Authentication for Critical Function
Published
2026-10-16T01:17Z
References (3)
https://github.com/xn0tsa/your-secrets-are-safe-with-me · [email protected]https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000001111111111100000000000000000000000011111111001111111111000000000000000000010110111111111100000000000000000001110/ · [email protected]https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab · [email protected]
EPSS history
Timeline
  • 17 OCT 03:27Z
    EPSS moved — → 1%
    epss
  • 15 OCT 20:42Z
    EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers
    cvelistv5
  • 15 OCT 20:42Z
    EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers
    cvelistv5