by Kastro
Paper/Archive/CVE-2026-68502

CVE-2026-68502

grisuno LazyOwn — LazyOwn: Unauthenticated Socket.IO `input` Event Reaches LazyOwn Command Dispatcher — Unauthenticated RCE

EPSS 1.0%public exploitCVSS 9.8
critical.is priorityof 100
52
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 62.0.620 × 2012.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches data.get('value') to LazyOwnShell.one_cmd, reaching LazyOwnShell.do_cmd and subprocess.call(command, shell=True), allowing unauthenticated remote code execution in the C2 process. This issue is fixed in 0.2.154.

Affected

ProductAffectedFixed inSource
LazyOwn< 0.2.154–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/grisuno/LazyOwn/security/advisories/GHSA-fr84-8cfg-59w4refgithub.com/grisuno/LazyOwn/commit/2e1e3a7b5da8149ae28a970b5883aefa42921652refgithub.com/grisuno/LazyOwn/releases/tag/release/0.2.154