# CVE-2026-105035: EnergizeLab FirmwareUpdater hard-coded encryption key

Source: https://junglewise.ai/threats/cve-2026-105035-the-energizelab-firmwareupdater-aarch64-elf-distributed-in-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-105035 · Severity: high · CVSS 7.8 · Published 2026-10-15

EnergizeLab's firmware update tool uses a single encryption key that is the same across all customer installations. An attacker who extracts this key from the publicly distributed updater software can decrypt legitimate firmware updates and create counterfeit ones, potentially installing malicious firmware on any device that trusts the updater. This could lead to complete compromise of affected devices.

Vendors: [EnergizeLab](https://junglewise.ai/threats/vendors/energizelab).

## Quick answers

**Is CVE-2026-105035 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105035 being exploited in the wild.

**How severe is CVE-2026-105035?** High severity, with a CVSS score of 7.8, published 15 October 2026.

**Which products and versions are affected?** EnergizeLab FirmwareUpdater unspecified.

**Is there a fix for CVE-2026-105035?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-105035 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-105035?** Check whether you run EnergizeLab FirmwareUpdater at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The FirmwareUpdater (AArch64 ELF binary distributed via CDN) employs a hard-coded AES encryption key shared across all installations, violating cryptographic best practices. An attacker with network access or possession of the binary can extract the key, then decrypt and forge firmware packages for any device relying on this updater for authentication. The vulnerability enables unauthorized firmware installation without requiring any special privileges or user interaction on the target device.

## Affected products

- EnergizeLab FirmwareUpdater unspecified

## Timeline

- 2026-10-15: disclosed

## References

- [https://github.com/xn0tsa/your-secrets-are-safe-with-me](https://github.com/xn0tsa/your-secrets-are-safe-with-me)
- [https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000001111111111100000000000000000000000011111111100111111111000000000000000000011111111111111100000000000000000001111/](https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000001111111111100000000000000000000000011111111100111111111000000000000000000011111111111111100000000000000000001111/)