CVE-2026-68502

9.8 Critique

Publiée le 30/07/2026 à 23:18 · Modifiée le 24/10/2026 à 00:10 · Analyse NVD reportée · Source : security-advisories@github.com

Description

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches data.get('value') to LazyOwnShell.one_cmd, reaching LazyOwnShell.do_cmd and subprocess.call(command, shell=True), allowing unauthenticated remote code execution in the C2 process. This issue is fixed in 0.2.154.

Traduire en français

Produits concernés

grisuno LazyOwn

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.8 Critique	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-306

Références

https://github.com/grisuno/LazyOwn/commit/2e1e3a7b5da8149ae28a970b5883aefa42921652
https://github.com/grisuno/LazyOwn/releases/tag/release/0.2.154
https://github.com/grisuno/LazyOwn/security/advisories/GHSA-fr84-8cfg-59w4
https://github.com/grisuno/LazyOwn/security/advisories/GHSA-fr84-8cfg-59w4

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories