PT-2026-115222

CVE-2026-105035

·

Published

2026-10-15

·

Updated

2026-10-15

Description by

CVSS 3.1
7.8
High
MetricsAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.
Exploitability
Fix
Researchers
Vendors
Affected products
Weakness enumeration
CWE-321: Use of Hard-coded Cryptographic Key
Related identifiers
CVE-2026-105035
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com