EnergizeLab
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| NestJS auth service | 2 | – | Oct 15, 2026 |
| FastAPI AI inference server | 2 | – | Oct 15, 2026 |
| AI Station firmware (RK3562) | 2 | – | Oct 15, 2026 |
| station-middleware | 2 | – | Oct 15, 2026 |
| Robot firmware (mode 104000) | 1 | – | Oct 15, 2026 |
| FirmwareUpdater | 1 | – | Oct 15, 2026 |
| Windows desktop app (EnergizeLabSetup-3.1.2-Win.exe) | 1 | – | Oct 15, 2026 |
Exploited and recent CVEs
- CVE-2026-105040 EnergizeLab Eilik User-ID Mass Assignment Account Takeover 0.3%
- CVE-2026-105039 EnergizeLab Station Middleware Admin APIs Missing Role Checks 0.3%
- CVE-2026-105038 EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching 0.6%
- CVE-2026-105037 EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read 0.4%
- CVE-2026-105036 EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks 0.2%
- CVE-2026-105036 EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks 0.2%
- CVE-2026-105036 EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks 0.2%
- CVE-2026-105035 EnergizeLab FirmwareUpdater Universal Hard-Coded AES Key 0.2%
- CVE-2026-105034 EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers 0.6%
- CVE-2026-105033 EnergizeLab AI Station Default Root Credentials with SSH Enabled 0.4%
- CVE-2026-105032 EnergizeLab Eilik AI Skill Upload Unauthenticated Path Traversal Arbitrary File Write 0.9%