EnergizeLab AI Station Default Root Credentials with SSH Enabled
Summary
| CVE | CVE-2026-105033 |
|---|---|
| State | PUBLISHED |
| Assigner | AHA |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-15 21:17:03 UTC |
| Updated | 2026-10-15 21:17:03 UTC |
| Description | The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log in as root and take full control of it. |
Risk And Classification
Primary CVSS: v3.1 8.8 HIGH from [email protected]
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-798 | CWE-798 CWE-798 Use of Hard-coded Credentials
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 8.8 | HIGH | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 8.8 | HIGH | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
AdjacentAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | EnergizeLab | AI Station Firmware RK3562 | affected n/a | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab | [email protected] | www.theverge.com | |
| github.com/xn0tsa/your-secrets-are-safe-with-me | [email protected] | github.com | |
| takeonme.org/gcves/GCVE-1337-2026-0000000000000000000000000000000000000000... | [email protected] | takeonme.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Sammy Azdoufal (en)
CNA: todb of AHA! (en)
There are currently no legacy QID mappings associated with this CVE.