CVE-2026-68503 Details

A vulnerability exists in LazyOwn RedTeam/APT Framework versions prior to 0.2.154, where default credentials for the Command and Control (C2) server are hardcoded and not properly secured. The credentials, 'LazyOwn' for both username and password, are included in 'payload.json' and 'core/payload_schema.py'. When the C2 server is started, these credentials are passed directly to the authentication system in 'lazyc2.py', allowing any attacker who knows the defaults to gain operator-level access to the C2 dashboard. This access includes full control over C2 operations, such as managing beacons and listeners, dispatching commands, and accessing reports and exfiltrated data.

Users are advised to update to LazyOwn version 0.2.154 or later, and to change the default C2 credentials before starting the server.