Ai Station Firmware Rk3562
Monthly
Firmware updates for EnergizeLab AI Station, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 are delivered over plain HTTP without integrity or authenticity verification, allowing a network-adjacent attacker who can intercept traffic to substitute malicious updates and gain full control of the affected device or Windows host. The flaw is CWE-494 (download of code without integrity check), with a CVSS 3.1 base score of 7.5 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning the attack is unauthenticated but requires an adjacent-network man-in-the-middle position and high complexity. No public exploit code or CISA KEV entry is identified in the provided data; exploitation depends on the attacker holding a MITM position, such as ARP spoofing, a rogue Wi-Fi access point, or a compromised router, and on an update check occurring.
The EnergizeLab AI Station (RK3562) firmware image ships with hard-coded root credentials and an SSH daemon enabled by default, so any attacker who can reach the device's SSH port from the same LAN or adjacent network segment can log in as root and take complete control of the unit. Rated CVSS 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw needs no authentication, no user interaction, and no pre-existing privilege on the device - the only barrier is network reachability, per the adjacent-network attack vector. No vendor patch has been identified at time of analysis, and no public exploit code or confirmed active exploitation (CISA KEV) was identified; because every device running stock firmware is affected by design rather than by misconfiguration, this is a high-priority issue for any organization with these units deployed, not a paper-only finding.
Firmware updates for EnergizeLab AI Station, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 are delivered over plain HTTP without integrity or authenticity verification, allowing a network-adjacent attacker who can intercept traffic to substitute malicious updates and gain full control of the affected device or Windows host. The flaw is CWE-494 (download of code without integrity check), with a CVSS 3.1 base score of 7.5 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning the attack is unauthenticated but requires an adjacent-network man-in-the-middle position and high complexity. No public exploit code or CISA KEV entry is identified in the provided data; exploitation depends on the attacker holding a MITM position, such as ARP spoofing, a rogue Wi-Fi access point, or a compromised router, and on an update check occurring.
The EnergizeLab AI Station (RK3562) firmware image ships with hard-coded root credentials and an SSH daemon enabled by default, so any attacker who can reach the device's SSH port from the same LAN or adjacent network segment can log in as root and take complete control of the unit. Rated CVSS 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw needs no authentication, no user interaction, and no pre-existing privilege on the device - the only barrier is network reachability, per the adjacent-network attack vector. No vendor patch has been identified at time of analysis, and no public exploit code or confirmed active exploitation (CISA KEV) was identified; because every device running stock firmware is affected by design rather than by misconfiguration, this is a high-priority issue for any organization with these units deployed, not a paper-only finding.