Vulnerabilidades de EnergizeLab

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de EnergizeLab: 5 registro(s), com severidade, exploração e correções.

NestJS auth service 2 Station-middleware 2 Robot firmware (mode 104000) 1 Windows desktop app (EnergizeLabSetup-3.1.2-Win.exe) 1

Somente exploradas (KEV) →

CVE-2026-105040 Alta · 8.8 CWE-639 15/10/2026

EnergizeLab Eilik User-ID Mass Assignment Account Takeover

The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.

CVE-2026-105039 Crítica · 9.6 CWE-862 15/10/2026

EnergizeLab Station Middleware Admin APIs Missing Role Checks

EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.

CVE-2026-105037 Crítica · 9.9 CWE-73 15/10/2026

EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read

EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets.

CVE-2026-105036 Alta · 7.5 CWE-494 15/10/2026

EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks

EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a malicious update.

CVE-2026-105034 Alta · 8.2 CWE-287 15/10/2026

EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers

The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.