EnergizeLab

Exploited now

None of this vendor's CVEs are on CISA's known-exploited list.

Recent

• 8.8HighOct 15, 2026EnergizeLab NestJS auth service Auth bypass / access controlCVE-2026-105040The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.
• 9.6CriticalOct 15, 2026EnergizeLab station-middleware Auth bypass / access controlCVE-2026-105039EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.
• 9.8CriticalOct 15, 2026EnergizeLab FastAPI AI inference server Auth bypass / access controlCVE-2026-105038The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime.
• 9.9CriticalOct 15, 2026EnergizeLab station-middleware Path traversal / file handlingCVE-2026-105037EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets.
• 7.5HighOct 15, 2026EnergizeLab Robot firmware (mode 104000)CVE-2026-105036EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a malicious update.
• 7.8HighOct 15, 2026EnergizeLab FirmwareUpdater Crypto / certificateCVE-2026-105035The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.
• 8.2HighOct 15, 2026EnergizeLab NestJS auth service Auth bypass / access controlCVE-2026-105034The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.
• 8.8HighOct 15, 2026EnergizeLab AI Station firmware (RK3562) Auth bypass / access controlCVE-2026-105033The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log in as root and take full control of it.
• 9.1CriticalOct 15, 2026EnergizeLab FastAPI AI inference server Path traversal / file handlingCVE-2026-105032The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper with AI skill files used by Eilik and EilikO robots.

See every EnergizeLab entry on the dashboard.

Top products

• station-middleware2 CVEs in the last year, 2 critical
• NestJS auth service2 CVEs in the last year
• FastAPI AI inference server2 CVEs in the last year, 2 critical
• Robot firmware (mode 104000)1 CVE in the last year
• FirmwareUpdater1 CVE in the last year
• AI Station firmware (RK3562)1 CVE in the last year