CVE-2026-68502

Received Received - Intake

Unauthenticated Remote Code Execution in LazyOwn RedTeam Framework

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches data.get('value') to LazyOwnShell.one_cmd, reaching LazyOwnShell.do_cmd and subprocess.call(command, shell=True), allowing unauthenticated remote code execution in the C2 process. This issue is fixed in 0.2.154.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-68502

Affected Vendors & Products

Vendor	Product	Version / Range
lazyown	lazyown	to 0.2.154 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

LazyOwn RedTeam/APT Framework before version 0.2.154 has an unauthenticated Socket.IO input handler in lazyc2.py that executes user-provided commands via LazyOwnShell.do_cmd and subprocess.call with shell=True, enabling remote code execution in the C2 process without authentication.

Detection Guidance

Detecting this vulnerability requires checking for unauthenticated Socket.IO event handlers in LazyOwn versions prior to 0.2.154. Inspect network traffic for Socket.IO connections to lazyc2.py endpoints. Check running processes for LazyOwnShell.do_cmd or subprocess.call with shell=True. Verify installed version of LazyOwn is below 0.2.154.

Impact Analysis

An attacker could exploit this to execute arbitrary code on the system running the LazyOwn C2 server, potentially taking full control of the machine, stealing data, or using it as a foothold in a network.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information, potentially resulting in legal penalties and loss of compliance certifications.

Mitigation Strategies

Immediately upgrade LazyOwn RedTeam/APT Framework to version 0.2.154 or later to patch the unauthenticated Socket.IO input event handler vulnerability. If immediate upgrade is not possible, restrict network access to the LazyOwn C2 service to prevent unauthenticated remote code execution.

Hi! I’m here to help you understand CVE-2026-68502. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70