{"vulnerability": "CVE-2026-105035", "sightings": [{"uuid": "1471e0c4-3c88-459a-b483-1bf4504ccd17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105035", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117446899091070276", "content": "CVE-2026-105035 EnergizeLab FirmwareUpdater Universal Hard-Coded AES Key The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.\nhttps://www.cve.org/CVERecord?id=CVE-2026-105035https://github.com/xn0tsa/your-secrets-are-safe-with-mehttps://takeonme.org/gcves/GCVE-1337-2026-00000000000000000001111111111100000000000000000000000011111111100111111111000000000000000000011111111111111100000000000000000001111/https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab#EnergizeLab #FirmwareUpdater#CVE_2026_105035#bot", "creation_timestamp": "2026-10-15T20:50:59.791353Z"}]}