CVE-2026-105036: EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks
EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.120260617182218release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a malicious update.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, or the EnergizeLab Windows desktop app 3.1.2 are exposed when they download firmware updates over a network path an attacker can intercept or modify.
What does an attacker need to exploit it?
An attacker must be able to intercept or alter the plain-HTTP firmware update traffic. No privileges or user interaction are required according to the supplied vector.
What is the likely impact of a successful attack?
An attacker could substitute a malicious firmware update because the update is neither integrity-checked nor authenticated. The reported impact includes high confidentiality, integrity, and availability effects.