CVE-2026-105034

HighCVSS 8.2/10Last modified Oct 16, 2026

Description

The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-287 CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Oct 15, 2026
Last modified: Oct 16, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1050357.8The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. CVE-2026-1050367.5EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 down CVE-2026-1050379.9EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary file CVE-2026-1050389.8The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication CVE-2026-1050399.6EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated CVE-2026-1050408.8The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user CVE-2026-1050433.6MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that are never visible in the Simulink Editor but will c CVE-2026-1050448.5Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Sec CVE-2026-1050464.3Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints.CVE-2026-1050484.0The Playground feature of Zilliz Attu before 3.0.0 allows SSRF (proxying of requests to private IP addresses).CVE-2026-1050495.8Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URL CVE-2026-1050507.1PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation