EnergizeLab Eilik: Missing authentication in device token issuance
Summary
The NestJS authentication service of the EnergizeLab Eilik robot platform issues device tokens for arbitrary robot serial numbers without checking the requester. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the vendor's cloud services. The Eilik is a desk companion robot marketed largely toward children, and the researcher reports related privacy exposure in the same platform.
Affected
- EnergizeLab NestJS auth service, version 1.8.2 (per VulDB, Offseq and Strix)
- Earlier versions: Unknown.
Fixed in
- Unknown. No patched release or vendor advisory was found.
Workaround
- No vendor-sanctioned workaround known.
- Operators: restrict network access to the auth service and monitor device-token issuance for unexpected serial numbers.
- Owners: keep the robot off sensitive networks and do not use it for confidential data until the vendor confirms a fix.
Exploitation
- No known exploitation in the wild. CISA SSVC: exploitation none, automatable yes.
- Public proof of concept: conflicting reports; not verified for this CVE.
Our recommendation
- Inventory any Eilik devices and related accounts in your organisation.
- Keep Eilik devices off business networks.
- Check with the vendor for a fix before re-enabling any device.
- Monitor for unexpected device activity if the auth service is operated in-house.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-105034 at OpenCVE app.opencve.io
- VulDB 420899 vuldb.com
- Offseq radar entry radar.offseq.com
- Strix CVE-2026-105034 www.strix.ai
- AHA! advisory (takeonme.org) takeonme.org
- Research write-up on GitHub github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:56.
Original description (NVD)
The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.