EUVD-2026-102430Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | All signals point to a genuinely easy-to-exploit flaw, but one with bounded impact and no confirmation of real-world use. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates a remote, unauthenticated attack of low complexity requiring no user interaction - consistent with the CWE-306 (Missing Authentication) classification and the description's claim that device tokens are issued for arbitrary serial numbers. Impact is deliberately scoped by the vector: C:L/I:H/A:N means the real damage is device impersonation/spoofing (high integrity impact) rather than mass data theft or outage. EPSS is NOT provided, so exploitation probability cannot be quantified. KEV status is NOT present, so there is no evidence of active exploitation - do not treat this as exploited-in-the-wild. One GitHub reference exists but its contents are not verified as a working exploit, so POC availability is unconfirmed. Net assessment: this is a real, trivially-exploitable auth bypass worth prompt attention for anyone operating the EnergizeLab Eilik cloud, but the absence of KEV, EPSS, availability impact, and a confirmed POC - combined with the niche consumer-robot footprint - places it below internet-scale emergencies. The score (8.2) is driven by ease of access, not by breadth or severity of consequence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
The EnergizeLab Eilik NestJS authentication service grants device tokens for arbitrary robot serial numbers without requiring any credential, so an unauthenticated remote attacker can mint a valid token for any Eilik robot and impersonate that device against the vendor's cloud services. Rated 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N), the flaw is trivially reachable over the network with no authentication or user interaction, and the dominant impact is to integrity of device identity rather than to confidentiality or availability. There is no CISA KEV entry and no public exploit code identified at time of analysis, and no EPSS percentile was supplied with this record, so the practical risk is a genuinely easy-to-exploit flaw with bounded, identity-spoofing impact and no confirmation of real-world use; assessment signals point the same way.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation must be compensating until EnergizeLab ships a fix for the NestJS auth service. The most effective control is to stop treating the serial number as a credential: require a per-device secret established at factory provisioning or first-pairing (a flashed key pair, hardware-backed certificate, or HMAC challenge-response) and reject any token request that does not prove possession of it - the trade-off is a fleet provisioning/OTA effort and support burden for already-shipped units. Until that exists, add server-side validation that a requested serial number belongs to an active, enrolled device, rate-limit and anomaly-score token issuance per source IP and per serial to make enumeration impractical, and alert on tokens minted for serials that have never been paired - these reduce but do not eliminate the weakness because the endpoint remains unauthenticated (PR:N). For fleet owners, force rotation and revocation of all outstanding device tokens and monitor cloud audit logs for duplicate or conflicting sessions on the same serial, which is the observable footprint of impersonation. Long term, bind tokens to a device public key and shorten token lifetimes with refresh based on that key; degraded-function trade-offs of aggressive token expiry should be weighed against support load. Consult the referenced disclosure material (https://github.com/xn0tsa/your-secrets-are-safe-with-me and https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab) and check EnergizeLab's channels for a patched auth-service release, since the exact fixed version is not available in the provided data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a missing-authentication-for-critical-function flaw (CWE-306) in EnergizeLab's cloud authentication tier, which is built on NestJS - the Node.js/TypeScript server framework whose module, guard, and decorator system normally enforces route-level auth. The affected component, tracked by CPE cpe:2.3:a:energizelab:nestjs_auth_service (wildcard version, i.e. all tracked releases), acts as the token authority for the Eilik robot fleet: it is expected to verify a physical device's identity before issuing the bearer token that the cloud backend trusts as proof of device identity. Because the issuance path accepts a serial number and returns a token without validating a per-device secret, provisioning record, or any client credential (PR:N in the vector), the device-identity trust model collapses - the serial number functions as the only, guessable or enumerable input. Token issuance is a 'critical function' under CWE-306 precisely because downstream services treat its output as cryptographic-grade proof of identity; once a token is minted, the attacker inherits whatever the cloud permits a legitimate robot to do, which is consistent with the high integrity (I:H) and low confidentiality (C:L) component scores and the absence of availability impact.
Know when Nestjs Auth Service gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Primary rating from Vendor (AHA) · only source for this CVE.
CVSS VectorVendor: AHA
DescriptionCVE.org
The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.
Executive ViewAI
An authentication weakness in the EnergizeLab Eilik NestJS device-token service allows anyone who can reach the service to obtain valid cloud credentials for any Eilik robot simply by supplying a serial number, with no login, key, or user action required. Because the affected component is vendor-operated cloud infrastructure rather than customer-deployed software, EnergizeLab is the only party able to remediate the root cause, leaving every Eilik owner and any business deploying these robots in a fleet exposed to device impersonation until the vendor acts. Leadership should care because trust in device identity underpins cloud telemetry, remote commands, and any warranty or safety decisions tied to a specific unit, and that trust can currently be forged at will.
No vendor-released patch identified at time of analysis. Interim mitigations: press EnergizeLab to enforce device-bound authentication or attestation on token issuance; monitor cloud API logs for tokens minted against unauthorized or unrecognized robot serial numbers; restrict and segment Eilik device and management-plane network traffic through a monitored proxy or isolated VLAN; treat all Eilik-sourced telemetry and identity assertions as untrusted until the vendor confirms a fix; and avoid automating sensitive actions based solely on claimed device serial number.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB