CVE-2026-105035

EnergizeLab FirmwareUpdater Universal Hard-Coded AES Key

7.8 High

The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.20%Unchanged since Oct 16, 2026

What each source reports

CVE List Score used 7.8

EnergizeLab FirmwareUpdater Universal Hard-Coded AES Key

Record: CVE-2026-105035
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-321
Updated: 2026-11-02

EUVDEUVD-2026-102431 7.8

Record: EUVD-2026-102431
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-mqqq-chp3-ffv9 7.8

The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard...

Record: GHSA-mqqq-chp3-ffv9
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-321
Updated: 2026-11-02

NVD 7.8

Record: CVE-2026-105035
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-321
Updated: 2026-11-02

Affected products

energizelab firmwareupdater

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-105035 is a high vulnerability (CVSS 7.8) in Energizelab Firmwareupdater, published October 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. No source names a fixed version.