Firmwareupdater
Monthly
Firmware forgery is possible in the EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the public CDN bin.zip) because every installation ships with the same hard-coded AES key, so an attacker who recovers that key can decrypt and craft firmware packages accepted by any device that trusts the updater. Key recovery needs no credentials since the binary is publicly downloadable (PR:N), but the forged image must actually reach a device and be installed by an operator (UI:R), yielding a locally-vectored CVSS 3.1 score of 7.8 with high confidentiality, integrity and availability impact. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the result is a systemic, fleet-wide trust failure rather than a remotely triggerable network flaw.
Firmware forgery is possible in the EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the public CDN bin.zip) because every installation ships with the same hard-coded AES key, so an attacker who recovers that key can decrypt and craft firmware packages accepted by any device that trusts the updater. Key recovery needs no credentials since the binary is publicly downloadable (PR:N), but the forged image must actually reach a device and be installed by an operator (UI:R), yielding a locally-vectored CVSS 3.1 score of 7.8 with high confidentiality, integrity and availability impact. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the result is a systemic, fleet-wide trust failure rather than a remotely triggerable network flaw.