# CVE-2026-105036: EnergizeLab AI Station firmware insecure update delivery

Source: https://junglewise.ai/threats/cve-2026-105036-energizelab-ai-station-firmware-eiliko-linux-robot-firmware-v2-1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-105036 · Severity: high · CVSS 7.5 · Published 2026-10-15

EnergizeLab AI Station, EilikO Linux robot, and the Windows desktop app download firmware updates over unencrypted HTTP without verifying the update's authenticity or integrity. An attacker on the same network or able to intercept traffic can substitute a malicious firmware update, gaining full control of the robot and any connected systems.

Vendors: [EnergizeLab](https://junglewise.ai/threats/vendors/energizelab).

## Quick answers

**Is CVE-2026-105036 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105036 being exploited in the wild.

**How severe is CVE-2026-105036?** High severity, with a CVSS score of 7.5, published 15 October 2026.

**Which products and versions are affected?** EnergizeLab EilikO Linux robot v2.1_20260617182218_release; EnergizeLab Windows desktop app 3.1.2.

**Is there a fix for CVE-2026-105036?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-105036 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-105036?** Check whether you run EnergizeLab AI Station, EnergizeLab EilikO Linux robot or EnergizeLab Windows desktop app at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The firmware update mechanism in EnergizeLab AI Station, EilikO Linux robot firmware, and the Windows desktop app uses unencrypted HTTP and does not perform cryptographic verification of downloaded updates. An attacker with network access can perform a man-in-the-middle attack to intercept update requests and serve malicious firmware, resulting in arbitrary code execution on the device.

## Affected products

- EnergizeLab AI Station
- EnergizeLab EilikO Linux robot v2.1_20260617182218_release
- EnergizeLab Windows desktop app 3.1.2

## Timeline

- 2026-10-15: disclosed

## References

- [https://github.com/xn0tsa/your-secrets-are-safe-with-me](https://github.com/xn0tsa/your-secrets-are-safe-with-me)
- [https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000111111111100000000000000000000000011111100001111111101000000000000000000011111111111111100000000000000000010000/](https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000111111111100000000000000000000000011111100001111111101000000000000000000011111111111111100000000000000000010000/)

## Related threats

- [EnergizeLab AI Station default credentials in SSH](https://junglewise.ai/threats/cve-2026-105033-the-energizelab-ai-station-rk3562-firmware-image-ships-with)