CVE-2026-105035: CVE-2026-105035: güvenlik açığı

Açıklama (NVD)

The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.

Özet bilgiler

CVSS v3.1

7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

%0,20 (yüzdelik 10)

CWE

CWE-321

Yama

Yok / bilinmiyor

Kaynaklar

• NVD kaydı
• github.com
• takeonme.org
• www.theverge.com
• CWE-321