CVE-2026-105034
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.
Risk Assessment
An attacker can impersonate any robot, access data and cloud functions belonging to the victim, and disrupt service operations.
Recommendation
Implement authentication and authorization for device token issuance and bind tokens to a specific, verified serial number; until fixed, monitor for anomalous token requests.
Other vulnerabilities in EnergizeLab Eilik NestJS auth service
Original NVD description (English source)
The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS