CVE-2026-105035: EnergizeLab FirmwareUpdater Universal Hard-Coded AES Key
The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.
Affected Software
Event History
Frequently Asked Questions
Which installations and devices are exposed?
All installations of the AArch64 FirmwareUpdater that use the shared hard-coded AES key are affected. Any device that trusts firmware packages protected with that key can be targeted with decrypted or forged packages.
What does an attacker need to exploit this issue?
The attacker must recover the AES key from the updater. The published severity vector indicates local attack access, no required privileges, and required user interaction.
What is the potential impact if a forged package is accepted?
An attacker can decrypt firmware packages and forge packages for devices that trust the updater's shared key. The severity vector rates confidentiality, integrity, and availability impact as high.