[CVE-2026-105035] The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-cod…

Descripción técnica

The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.

Puntuación CVSS

Score: 7.8/10 — Severidad: HIGH — Estado NIST: Received

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Debilidades (CWE)

CWE-321

Fuente oficial

Publicado en NIST NVD.