| EnergizeLab Eilik
|
|
Security Grade
Calculator v1
|
EnergizeLab Eilik
Release Date: 2021-11-09 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
|
| Prior attacks
|
None
|
🔗 Proof
|
|
| Updatability
|
Very common
|
🔗 Proof
|
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
No
|
🔗 Proof
|
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
|
| Storage
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Absent
|
🔗 Proof
|
|
| Authentication
|
Absent
|
🔗 Proof
|
|
| Brute-force protection
|
Absent
|
🔗 Proof
|
|
| Event logging
|
Absent
|
🔗 Proof
|
|
| Passwords
|
Default/Common/Easy to guess
|
🔗 Proof
|
|
| Category Score
|
Score: 3 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Proprietary firmware (Companion App: Eilik Update Tool)
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: 450 mAh, runtime approx. 1.5 hours • Power: 5V 1A USB input • Charging: USB Type-C, charging time approx. 1 hour
|
| Display & Camera
|
Display: 1.54-inch 128×64 OLED • Camera:
|
| Sound & Connectivity
|
Sound: 3W speaker • Connectivity: No Wi-Fi or internet required for operation; multiple Eilik robots can interconnect
|
| Physical (Dimensions & Mass)
|
Dimensions: 108 × 105 × 133 mm • Mass: 230 g
|
The EnergizeLab Eilik is a desktop companion robot that, while designed for emotional interaction and capable of operating offline without Wi-Fi, exposes a critical cloud-side authentication flaw. CVE-2026-105034 (CWE-287) reveals that the Eilik NestJS authentication service (version 1.8.2) issues device tokens for arbitrary robot serial numbers without verifying ownership or requiring authentication. This allows an unauthenticated remote attacker to obtain valid tokens and fully impersonate any Eilik robot against the cloud services. The vulnerability fundamentally breaks the system's authentication and account management, making brute-force protection and event logging absent. Although communications may be encrypted, the compromised token generation process renders the security model ineffective. No known countermeasure was available at the time of disclosure in October 2026.
