Robot Firmware Mode 104000
Monthly
Firmware updates for EnergizeLab AI Station, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 are delivered over plain HTTP without integrity or authenticity verification, allowing a network-adjacent attacker who can intercept traffic to substitute malicious updates and gain full control of the affected device or Windows host. The flaw is CWE-494 (download of code without integrity check), with a CVSS 3.1 base score of 7.5 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning the attack is unauthenticated but requires an adjacent-network man-in-the-middle position and high complexity. No public exploit code or CISA KEV entry is identified in the provided data; exploitation depends on the attacker holding a MITM position, such as ARP spoofing, a rogue Wi-Fi access point, or a compromised router, and on an update check occurring.
Firmware updates for EnergizeLab AI Station, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 are delivered over plain HTTP without integrity or authenticity verification, allowing a network-adjacent attacker who can intercept traffic to substitute malicious updates and gain full control of the affected device or Windows host. The flaw is CWE-494 (download of code without integrity check), with a CVSS 3.1 base score of 7.5 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning the attack is unauthenticated but requires an adjacent-network man-in-the-middle position and high complexity. No public exploit code or CISA KEV entry is identified in the provided data; exploitation depends on the attacker holding a MITM position, such as ARP spoofing, a rogue Wi-Fi access point, or a compromised router, and on an update check occurring.