CVE-2026-105034: EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers
The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker only needs network access to the affected NestJS authentication service and a robot serial number. No authentication, privileges, or user interaction are required.
Who is exposed?
Cloud services that accept these device tokens are exposed to an attacker impersonating a device associated with an arbitrary serial number. The issue affects the authentication service's device-token issuance behavior.
What can an attacker do with an issued token?
The attacker can obtain a valid device token for any serial number and act as that device against the cloud services. The provided data indicates impacts to integrity and confidentiality, but not availability.