You do not have permission to edit this page, for the following reasons:
The EnergizeLab Eilik is a desktop companion robot that, while designed for emotional interaction and capable of operating offline without Wi-Fi, exposes a critical cloud-side authentication flaw. CVE-2026-105034 (CWE-287) reveals that the Eilik NestJS authentication service (version 1.8.2) issues device tokens for arbitrary robot serial numbers without verifying ownership or requiring authentication. This allows an unauthenticated remote attacker to obtain valid tokens and fully impersonate any Eilik robot against the cloud services. The vulnerability fundamentally breaks the system's authentication and account management, making brute-force protection and event logging absent. Although communications may be encrypted, the compromised token generation process renders the security model ineffective. No known countermeasure was available at the time of disclosure in October 2026.
For new submissions, pages will appear blank until approval.
Summary: This is a minor edit Watch this page
Save page Show preview Show changes Cancel
