EUVD-2026-102428Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach FastAPI AI upload endpoint on network
-
DeliverySend unauthenticated request with traversal filename
-
ExploitWrite arbitrary file outside upload dir
-
ExecutionOverwrite AI skill files
-
ImpactTamper Eilik/EilikO robot behavior
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Eilik/EilikO FastAPI AI inference and profiling service that exposes the AI-skill upload endpoint; per the description this endpoint requires NO authentication and applies NO path constraints, so default configurations are exploitable with a single crafted upload request using path-traversal filenames. The practical limiting factor is reachability, not credentials or configuration: these are consumer robots typically reachable only from the local network segment unless the owner has explicitly exposed or port-forwarded the service to the internet, which sharply narrows realistic exposure despite the AV:N network vector. No user interaction, authentication, or non-default feature toggle is needed once the endpoint is reachable. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, base 9.1) describes an unauthenticated, network-reachable, low-complexity flaw with no user interaction and high integrity and availability impact - a genuinely easy-to-trigger primitive (unrestricted/path-traversal file write, CWE-434). On raw technical merit this is a high priority. However, several real-world-risk signals are MISSING or SOFT: no EPSS score is provided, the CVE is NOT listed in CISA KEV, and POC availability is not explicitly flagged. The references include a GitHub repository (xn0tsa/your-secrets-are-safe-with-me) that MAY contain proof-of-concept code and a mainstream news article (The Verge) describing a robot 'hack', but neither confirms weaponized or in-the-wild exploitation - treat these as unverified exploitation interest, not confirmed active exploitation. The dominant mitigating factor is NOT the CVSS metrics but the affected product itself: EnergizeLab Eilik/EilikO is a consumer desktop companion robot, so despite AV:N the realistic attack surface is overwhelmingly a local network segment rather than the open internet, which is a far smaller blast radius than the network vector alone implies. Net: technically critical and trivially exploitable where reachable, but the limited and non-enterprise deployment footprint makes this targeted/opportunistic rather than mass-exploitable. |
| Exploit ScenarioDerived | An attacker on the same network as an Eilik or EilikO robot discovers the exposed FastAPI AI-inference/profiling service and sends a crafted unauthenticated upload request whose filename contains path-traversal sequences, writing or overwriting an arbitrary file outside the intended upload directory. Because AC:L/PR:N/UI:N, no credentials, user interaction, or special timing are needed, and the attacker can tamper with the AI skill files that govern robot behavior. A GitHub reference exists that may provide proof-of-concept tooling, but no public exploit is independently confirmed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Unauthenticated path-traversal file writes in the EnergizeLab Eilik and EilikO AI skill upload endpoint allow any remote attacker who can reach the FastAPI AI inference and profiling service to write arbitrary files on the robot's host system by supplying crafted traversal filenames in an upload request. Because the endpoint enforces neither authentication nor path constraints, exploitation is a straightforward, low-complexity primitive that lets an attacker tamper with the AI skill files the robots execute, degrading or subverting robot behavior and causing high integrity and availability impact (CVSS 3.1 base 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, CWE-434); confidentiality is assessed as unaffected. The practical limiting factor is network reachability rather than credentials or configuration - these are consumer robots whose service is normally confined to the local network segment, so real-world exposure is materially narrower than the AV:N vector implies, and no public exploit code or confirmed active exploitation was identified at time of analysis (the flaw itself needs no user interaction or non-default toggle once the endpoint is reachable).
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation must currently rely on reducing reachability and hardening the service. The most effective control is to ensure the FastAPI AI inference and profiling service is not exposed outside the local network: remove any router port-forward, UPnP mapping, or reverse-proxy rule that publishes it, and place Eilik/EilikO robots on an isolated IoT VLAN or guest SSID so that even a compromised LAN peer cannot reach the upload endpoint - the trade-off is loss of remote management from outside the home network. If the skill upload functionality is not needed, disable that endpoint or the inference/profiling service entirely, accepting that AI skill updates will no longer work; if it must run, bind it to loopback rather than 0.0.0.0 and front it with a reverse proxy that enforces authentication and rejects filenames containing path separators or '../' sequences, recognizing that such proxy-level filtering can be bypassed by encoding tricks and is a mitigation rather than a fix. Network monitoring for upload POSTs with traversal patterns in filenames or for unexpected writes to skill directories provides a compensating detection layer, but does not prevent the integrity damage once a write lands. Track https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab and the referenced GCVE record for an EnergizeLab firmware or service update, and apply an exact fix version only once the vendor publishes one.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is the EnergizeLab FastAPI-based AI inference and profiling server that back-ends the Eilik and EilikO consumer robots, tracked in the affected CPE as cpe:2.3:a:energizelab:fastapi_ai_inference_server (all versions). At its root this is CWE-434, Unrestricted Upload of File with Dangerous Type, combined with classic path traversal: the AI-skill upload handler accepts a client-supplied filename and writes it to disk without normalizing or constraining the resulting path, so sequences such as ../ escape the intended skill directory and allow the attacker to overwrite or create files elsewhere on the filesystem. The absence of any authentication check on the endpoint (reflected in the PR:N vector) means the only precondition is that the service be reachable - no credential, session, or privileged feature must first be obtained. FastAPI is a Python ASGI framework where such handlers are typically written with async file I/O; safe implementations must resolve the target path against a fixed base directory and reject anything that escapes it, which this endpoint does not do. The integrity impact is high because the written content lands in the same file space used for AI skill definitions executed by the robot, and the availability impact is high because arbitrary writes can corrupt or replace files the service depends on.
Know when Fastapi Ai Inference Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Unauthenticated, no-interaction, low-complexity network file-write endpoint gives PR:N/UI:N/AC:L; write-only skill tampering yields I:H and A:H with C:N since no data is read.
Primary rating from Vendor (AHA).
CVSS VectorVendor: AHA
DescriptionCVE.org
The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper with AI skill files used by Eilik and EilikO robots.
Executive ViewAI
EnergizeLab Eilik and EilikO consumer robots are affected by a critical unauthenticated path-traversal file-write flaw in the AI skill upload service, enabling attackers with local network access to tamper with the AI skills the robots execute and degrade or subvert robot behavior; no public exploit identified at time of analysis. Because no vendor-released patch identified at time of analysis, leadership should prioritize containment, network segmentation, and vendor engagement to protect affected robot fleets and maintain customer trust.
No vendor-released patch identified at time of analysis; interim mitigations include segmenting Eilik and EilikO robots and their FastAPI AI service onto an isolated management VLAN, blocking external or untrusted access to the skill upload endpoint, disabling the upload feature where possible, enforcing authentication and path normalization at a reverse proxy or WAF, monitoring for traversal filenames and unexpected file writes, and maintaining file integrity monitoring on robot hosts. Apply vendor patch when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Exploit-DB