PT-2026-29008 · Al Ko · Al-Ko Robolinho Update

Piotr Ptaszek · Publicado 2026-03-30 · Atualizado 2026-03-30 · CVE-2026-1612

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions AL-KO Robolinho Update Software version 8.0.21.0610 versions prior to 8.0.21.0610

Description The AL-KO Robolinho Update Software contains hard-coded AWS Access and Secret keys, potentially granting unauthorized access to AL-KO's AWS bucket. Utilizing these keys directly could provide an attacker with broader access than the application itself. Access granted by these keys includes at least read access to objects within the bucket. The vendor was notified of this issue but did not provide details regarding vulnerable version ranges.

Recommendations Update to version 8.0.21.0610 or later. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2026-1612

Produtos afetados

Al-Ko Robolinho Update

Referências · 3

• https://twitter.com/CVEnew/status/2038618085251301493 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-1612 · Nota de Segurança
• https://cert.pl/en/posts/2026/03/CVE-2026-1612 · Nota