CVE-2026-68502

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches data.get('value') to LazyOwnShell.one_cmd, reaching LazyOwnShell.do_cmd and subprocess.call(command, shell=True), allowing unauthenticated remote code execution in the C2 process. This issue is fixed in 0.2.154.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/grisuno/LazyOwn/commit/2e1e3a7b5da8149ae28a970b5883aefa42921652
https://github.com/grisuno/LazyOwn/releases/tag/release/0.2.154
https://github.com/grisuno/LazyOwn/security/advisories/GHSA-fr84-8cfg-59w4
https://github.com/grisuno/LazyOwn/security/advisories/GHSA-fr84-8cfg-59w4

Configurations

No configuration.

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) LazyOwn RedTeam/APT Framework es un framework de C2 y operaciones de equipo rojo impulsado por IA. Antes de la versión 0.2.154, el archivo lazyc2.py de LazyOwn registra un gestor de eventos de entrada de Socket.IO no autenticado que despacha data.get(’value’) a LazyOwnShell.one_cmd, llegando a LazyOwnShell.do_cmd y subprocess.call(command, shell=True), permitiendo la ejecución remota de código no autenticada en el proceso C2. Este problema está solucionado en la versión 0.2.154.

Information

Published : 2026-07-30 21:18

Updated : 2026-10-23 22:10

NVD link : CVE-2026-68502

Mitre link : CVE-2026-68502

CVE.ORG link : CVE-2026-68502

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-68502", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-68502", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-31T14:07:18.664082Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "grisuno", "product": "LazyOwn", "versions": [{"status": "affected", "version": "< 0.2.154"}]}]}], "published": "2026-07-30T21:18:13.317", "references": [{"url": "https://github.com/grisuno/LazyOwn/commit/2e1e3a7b5da8149ae28a970b5883aefa42921652", "source": "security-advisories@github.com"}, {"url": "https://github.com/grisuno/LazyOwn/releases/tag/release/0.2.154", "source": "security-advisories@github.com"}, {"url": "https://github.com/grisuno/LazyOwn/security/advisories/GHSA-fr84-8cfg-59w4", "source": "security-advisories@github.com"}, {"url": "https://github.com/grisuno/LazyOwn/security/advisories/GHSA-fr84-8cfg-59w4", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches data.get('value') to LazyOwnShell.one_cmd, reaching LazyOwnShell.do_cmd and subprocess.call(command, shell=True), allowing unauthenticated remote code execution in the C2 process. This issue is fixed in 0.2.154."}, {"lang": "es", "value": "LazyOwn RedTeam/APT Framework es un framework de C2 y operaciones de equipo rojo impulsado por IA. Antes de la versi\u00f3n 0.2.154, el archivo lazyc2.py de LazyOwn registra un gestor de eventos de entrada de Socket.IO no autenticado que despacha data.get(\u2019value\u2019) a LazyOwnShell.one_cmd, llegando a LazyOwnShell.do_cmd y subprocess.call(command, shell=True), permitiendo la ejecuci\u00f3n remota de c\u00f3digo no autenticada en el proceso C2. Este problema est\u00e1 solucionado en la versi\u00f3n 0.2.154."}], "lastModified": "2026-10-23T22:10:00.160", "sourceIdentifier": "security-advisories@github.com"}