CVE-2026-105033

HighCVSS 8.8

Published: 15/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

28th percentile - higher than 28% of all known CVEs

Summary

The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log in as root and take full control of it.

Risk Assessment

Default root credentials and open SSH allow easy device takeover by anyone with network access, potentially leading to data theft or use of the device as a network entry point.

Recommendation

Immediately change the default root password, disable SSH if not required, and restrict network access to the device; ultimately deploy firmware without default credentials.

Other vulnerabilities in EnergizeLab AI Station

CVE-2026-105036High
EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a malicious update.

Original NVD description (English source)

The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log in as root and take full control of it.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS