Hard-coded AWS Keys Found in AL-KO Robolinho App
AL-KO Robolinho Update Software embeds hard-coded AWS keys that let anyone read objects in AL-KO's S3 bucket, with the vendor unresponsive to disclosure.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of CVE-2026-1612, a vulnerability affecting AL-KO Robolinho Update Software in which hard-coded AWS Access and Secret keys are embedded in the application. These credentials grant at least read access to some objects in AL-KO's AWS S3 bucket, and could potentially allow greater access than intended by the application itself if abused directly rather than through the app.
Only version 8.0.21.0610 has been confirmed vulnerable, though other versions may also be affected since they were not tested. The vendor was notified early in the disclosure process but did not respond, leaving the issue unmitigated at time of publication. This is a supply-chain/credential-exposure issue typical of hard-coded secrets in IoT/embedded update mechanisms, posing a risk of unauthorized data access rather than remote code execution.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2026/03/CVE-2026-1612
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs