Coordinated disclosure: Energize Lab Eilik and Eiliko vulnerabilities

Evidence record

Coordinator describes nine separately enumerated CVEs (CVE-2026-105032 through 105040), access prerequisites and remediation status without confirming a mass firmware takeover.

Read the original source ↗

Claim-level citations (2)

• supportsEiliko companion robot backend exposed conversations and remote behavior controls: The researcher identifies an unsigned HTTP-delivered update chain with root-level startup actions and exposed supporting service credentials, but does not demonstrate distribution of malicious firmware to the installed fleet.

  Firmware and secret-handling CVE descriptions

• supportsEiliko companion robot backend exposed conversations and remote behavior controls: The coordinated advisory separately enumerates nine CVEs, CVE-2026-105032 through CVE-2026-105040, including distinct file access, identity, authentication, firmware and model administration issues.

  Vulnerability overview and individual CVE sections