Priority MEDIUM 40
The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment).
Vulnerabilities
9 records
Priority MEDIUM 43
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs.
Priority MEDIUM 50
The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication.
Priority MEDIUM 43
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path.
Priority LOW 34
EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authe…
TI-2026-75003 CVE-2026-105035
Hard-coded AES key in EnergizeLab FirmwareUpdater lets attackers forge firmware
Priority LOW 35
The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations.
Priority MEDIUM 42
The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication.
Priority MEDIUM 40
The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled.
Priority MEDIUM 47
The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths.