CVE-2026-68503

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and core/payload_schema.py and passes them unchanged to lazyc2.py HTTP Basic authentication, allowing any network-reachable attacker who knows the defaults to authenticate to the C2 dashboard with operator-level access. This issue is fixed in 0.2.154.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/grisuno/LazyOwn/commit/2e1e3a7b5da8149ae28a970b5883aefa42921652
https://github.com/grisuno/LazyOwn/releases/tag/release/0.2.154
https://github.com/grisuno/LazyOwn/security/advisories/GHSA-38jf-j9x7-jf6f
https://github.com/grisuno/LazyOwn/security/advisories/GHSA-38jf-j9x7-jf6f

Configurations

No configuration.

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) LazyOwn RedTeam/APT Framework es un framework impulsado por IA para C2 y operaciones de equipo rojo. Antes de la versión 0.2.154, LazyOwn incluía credenciales C2 predeterminadas LazyOwn y LazyOwn en payload.json y core/payload_schema.py, y las pasaba sin cambios a la autenticación básica HTTP de lazyc2.py, permitiendo a cualquier atacante accesible por red que conociera los valores predeterminados autenticarse en el panel de control del C2 con acceso de nivel de operador. Este problema está solucionado en la versión 0.2.154.

Information

Published : 2026-07-30 21:18

Updated : 2026-10-23 22:10

NVD link : CVE-2026-68503

Mitre link : CVE-2026-68503

CVE.ORG link : CVE-2026-68503

JSON object : View

Products Affected

No product.

CWE

CWE-1392

Use of Default Credentials

{"id": "CVE-2026-68503", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-68503", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-31T15:54:10.999458Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "grisuno", "product": "LazyOwn", "versions": [{"status": "affected", "version": "< 0.2.154"}]}]}], "published": "2026-07-30T21:18:13.460", "references": [{"url": "https://github.com/grisuno/LazyOwn/commit/2e1e3a7b5da8149ae28a970b5883aefa42921652", "source": "security-advisories@github.com"}, {"url": "https://github.com/grisuno/LazyOwn/releases/tag/release/0.2.154", "source": "security-advisories@github.com"}, {"url": "https://github.com/grisuno/LazyOwn/security/advisories/GHSA-38jf-j9x7-jf6f", "source": "security-advisories@github.com"}, {"url": "https://github.com/grisuno/LazyOwn/security/advisories/GHSA-38jf-j9x7-jf6f", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1392"}]}], "descriptions": [{"lang": "en", "value": "LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and core/payload_schema.py and passes them unchanged to lazyc2.py HTTP Basic authentication, allowing any network-reachable attacker who knows the defaults to authenticate to the C2 dashboard with operator-level access. This issue is fixed in 0.2.154."}, {"lang": "es", "value": "LazyOwn RedTeam/APT Framework es un framework impulsado por IA para C2 y operaciones de equipo rojo. Antes de la versi\u00f3n 0.2.154, LazyOwn inclu\u00eda credenciales C2 predeterminadas LazyOwn y LazyOwn en payload.json y core/payload_schema.py, y las pasaba sin cambios a la autenticaci\u00f3n b\u00e1sica HTTP de lazyc2.py, permitiendo a cualquier atacante accesible por red que conociera los valores predeterminados autenticarse en el panel de control del C2 con acceso de nivel de operador. Este problema est\u00e1 solucionado en la versi\u00f3n 0.2.154."}], "lastModified": "2026-10-23T22:10:00.160", "sourceIdentifier": "security-advisories@github.com"}