EnergizeLab AI Station firmware: Hard-coded default root credentials with SSH
Summary
The EnergizeLab AI Station firmware for the RK3562 platform ships with a default root credential and SSH enabled by default. An attacker with network access to the device can log in as root and take full control of it. No authentication is required, and the device could then serve as a foothold in the local network.
Affected
- EnergizeLab AI Station firmware (RK3562), versions not specified by the CNA record
- Affected versions: Unknown.
Fixed in
Unknown. No vendor advisory or fixed firmware found at time of writing.
Workaround
- Inventory all EnergizeLab AI Station and Eilik-family devices.
- Place the devices in an isolated VLAN or IoT segment.
- Block SSH (TCP 22) at the network edge and from untrusted hosts.
- Change the default root credential and disable SSH where the device settings allow it.
- Rotate any credentials that may have been exposed.
Exploitation
- No evidence of exploitation in the wild found.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- Not listed in CISA KEV.
- A public GitHub repository is referenced; its content for this CVE was not verified.
- EPSS 0.00354.
Our recommendation
- Only act if EnergizeLab devices are in use; confirm inventory first.
- Isolate the devices and block SSH access.
- Request a fixed firmware with unique credentials and SSH disabled by default from the vendor.
- Monitor for unexpected root logins where logging is possible.
- Re-check NVD and the vendor for an advisory.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record (CNA AHA, CVEProject cvelistV5) raw.githubusercontent.com
- GitHub repository xn0tsa/your-secrets-are-safe-with-me github.com
- GCVE entry (TakeOnMe) takeonme.org
- TakeOnMe coordinating research page takeonme.org
- OpenCVE CVE-2026-105033 app.opencve.io
- The Verge article on Eilik robot hack www.theverge.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:31.
Original description (NVD)
The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log in as root and take full control of it.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.