MajorCritical vulnerability

CVE-2026-105033 (CVSS 8.8)

NVD · officialPublished Oct 15, 2026Risk 37/100EPSS 0.4%

The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log in as root and take full control of it.

Technical details

CVSS

8.8

AV:Adjacent NetworkAC:LowPR:NoneUI:NoneC:HighI:HighA:High

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source