Is CVE-2026-105035 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-105035?

CVE-2026-105035 has a CVSS v3 severity of HIGH (7.8).

Back

CVE-2026-105035

Description

The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.