CVE-2026-105036CWE-494

CVE-2026-105036

High · published October 16, 2026

CVSS v3.1

7.5

EPSS

Percentile

13.7

In the wild

Unconfirmed

What it is

EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a malicious update.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00235 · 13.7th percentile
Weakness: CWE-494 · Download of Code Without Integrity Check
Published: 2026-10-16T01:17Z

References (3)

https://github.com/xn0tsa/your-secrets-are-safe-with-me · [email protected]https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000111111111100000000000000000000000011111100001111111101000000000000000000011111111111111100000000000000000010000/ · [email protected]https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab · [email protected]

EPSS history

Timeline

17 OCT 03:27Z
EPSS moved — → 0%
epss
15 OCT 20:43Z
EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks
cvelistv5
15 OCT 20:43Z
EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks
cvelistv5