EnergizeLab FirmwareUpdater: Hard-coded AES key in firmware updater

Summary

The EnergizeLab FirmwareUpdater, which is tied to firmware delivery for EnergizeLab companion robots, uses one hard-coded AES key shared by all installations. An attacker who recovers the key from the updater binary can decrypt and forge firmware packages that devices trusting the updater would accept. The CVSS vector requires local access, user interaction and no privileges; the exact attack path is not confirmed.

Affected

• Unknown. The CNA record lists the affected version as n/a.
• Other sources state that any version may be affected.
• Affected device list not confirmed.

Fixed in

Unknown. No patch or vendor advisory found.

Workaround

• No vendor mitigation found.
• Changing the key on a single device does not fix the issue; the vendor must ship updated firmware and updater binaries with a new key or signing scheme.
• Treat firmware images from this updater as untrusted and do not deploy them to business-critical devices.
• Consumer press advice is to keep affected robots off the Wi-Fi network; this is not a vendor instruction.

Exploitation

• CISA SSVC assessment: exploitation none, not automatable.
• Not listed in CISA KEV.
• VulDB reports no known exploit.
• A public GitHub write-up is referenced but its content is unverified.

Our recommendation

• Check whether EnergizeLab robots or the FirmwareUpdater are used on company networks, for example in education, retail or reception.
• If they are used, place them on a separate network segment and do not trust their firmware images.
• Monitor the NVD record and the vendor for an advisory and a fixed version.
• Relevance is low for most SMEs.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub: your-secrets-are-safe-with-me (technical write-up) github.com
• TakeOnMe GCVE advisory takeonme.org
• TakeOnMe CVE advisory (Eilik/Eiliko platform) takeonme.org
• VulDB entry 420901 vuldb.com
• OpenCVE record CVE-2026-105035 app.opencve.io
• Zetik news report (vendor response) www.zetik.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:54.