CVE-2026-105035

Publié : 15 octobre 2026

Modifié : 15 octobre 2026

Score CVSS

7.8

HIGH

Description détaillée

The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Références et Patchs

https://github.com/xn0tsa/your-secrets-are-safe-with-me https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000001111111111100000000000000000000000011111111100111111111000000000000000000011111111111111100000000000000000001111/https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab

Dernières Vulnérabilités

CVE-2026-92777

A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code.

VOIR DÉTAILS

CVE-2026-92629

A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges.

VOIR DÉTAILS

CVE-2026-89062

A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error.

VOIR DÉTAILS