SSH Root Access Flaw in EnergizeLab AI Station Firmware
CVE-2026-105033

8.8HIGH

Key Information:

Vendor

Energizelab

Status
Ai Station Firmware (rk3562)
Vendor
CVE Published:
15 October 2026

What is CVE-2026-105033?

The EnergizeLab AI Station firmware for the RK3562 model is vulnerable due to the presence of default root credentials and enabled SSH access. This configuration allows attackers with network access to exploit the vulnerability, gaining unrestricted root control over the device. Proper security measures should be taken to change default credentials and disable unnecessary services to mitigate the risks associated with unauthorized device access.

Affected Version(s)

AI Station firmware (RK3562)

References

https://github.com/xn0tsa/your-secrets-are-safe-with-me
technical-description
https://takeonme.org/gcves/GCVE-1337-2026-000000000000000...
third-party-advisory
https://www.theverge.com/tech/1010727/eiliko-robot-hack-e...
media-coverage

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sammy Azdoufal
todb of AHA!
.