CVE-2026-15683

{
  "id": "CVE-2026-15683",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-13T22:16:45.793",
  "lastModified": "2026-10-24T22:10:00.210",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Lorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lorex 2K Indoor Wi-Fi Security Cameras. User interaction is not required to exploit this vulnerability.\n\nThe specific flaw exists within the device management functionality. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-26851."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de Validación Incorrecta de Certificado en el Servidor de Gestión de Dispositivos de la Cámara de Seguridad Wi-Fi para Interiores Lorex 2K. Esta vulnerabilidad permite a atacantes adyacentes a la red ejecutar código arbitrario en instalaciones afectadas de Cámaras de Seguridad Wi-Fi para Interiores Lorex 2K. No se requiere interacción del usuario para explotar esta vulnerabilidad.\n\nLa falla específica existe dentro de la funcionalidad de gestión de dispositivos. El problema resulta de la falta de validación adecuada del certificado presentado por el servidor. Un atacante puede aprovechar esto en conjunto con otras vulnerabilidades para ejecutar código en el contexto de root. Fue ZDI-CAN-26851."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Lorex",
          "product": "2K Indoor Wi-Fi Security Camera",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "2.800.020000000.3.R.20220331",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV30": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.0",
          "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-14T12:51:55.987244Z",
          "id": "CVE-2026-15683",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-399/",
      "source": "[email protected]"
    }
  ]
}