Description
The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
EnergizeLab FirmwareUpdater
Default version status: unaffected
n/aaffected
References
- https://github.com/xn0tsa/your-secrets-are-safe-with-me ↗
- https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000001111111111100000000000000000000000011111111100111111111000000000000000000011111111111111100000000000000000001111/ ↗
- https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab ↗