CVE-2026-68502 Details
Description
LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches data.get('value') to LazyOwnShell.one_cmd, reaching LazyOwnShell.do_cmd and subprocess.call(command, shell=True), allowing unauthenticated remote code execution in the C2 process. This issue is fixed in 0.2.154.
A vulnerability allowing unauthenticated remote code execution has been identified in the LazyOwn RedTeam/APT Framework, specifically in versions prior to 0.2.154. The issue arises in the 'lazyc2.py' file, where an unauthenticated Socket.IO input event handler is registered. This handler dispatches data directly to the LazyOwnShell command interpreter, which then executes the commands using the subprocess module. As a result, an attacker can execute arbitrary commands on the server where LazyOwn is running.
Users can update to LazyOwn version 0.2.154 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 30, 2026CISA-ADP
Assessed Jul 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/grisuno/LazyOwn/security/advisories/GHSA-fr84-8cfg-59w4 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/grisuno/LazyOwn/commit/2e1e3a7b5da8149ae28a970b5883aefa42921652 | [email protected] | Source CodeVendor |
| https://github.com/grisuno/LazyOwn/releases/tag/release/0.2.154 | [email protected] | Release NotesVendor |
| https://github.com/grisuno/LazyOwn/security/advisories/GHSA-fr84-8cfg-59w4 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| LazyOwn | <= 1.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 31, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2026 | New CVE Received | [email protected] |