CVE-2026-68503

{
  "id": "CVE-2026-68503",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-30T21:18:13.460",
  "lastModified": "2026-10-23T22:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and core/payload_schema.py and passes them unchanged to lazyc2.py HTTP Basic authentication, allowing any network-reachable attacker who knows the defaults to authenticate to the C2 dashboard with operator-level access. This issue is fixed in 0.2.154."
    },
    {
      "lang": "es",
      "value": "LazyOwn RedTeam/APT Framework es un framework impulsado por IA para C2 y operaciones de equipo rojo. Antes de la versión 0.2.154, LazyOwn incluía credenciales C2 predeterminadas LazyOwn y LazyOwn en payload.json y core/payload_schema.py, y las pasaba sin cambios a la autenticación básica HTTP de lazyc2.py, permitiendo a cualquier atacante accesible por red que conociera los valores predeterminados autenticarse en el panel de control del C2 con acceso de nivel de operador. Este problema está solucionado en la versión 0.2.154."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "grisuno",
          "product": "LazyOwn",
          "versions": [
            {
              "version": "< 0.2.154",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-31T15:54:10.999458Z",
          "id": "CVE-2026-68503",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1392"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/grisuno/LazyOwn/commit/2e1e3a7b5da8149ae28a970b5883aefa42921652",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/grisuno/LazyOwn/releases/tag/release/0.2.154",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/grisuno/LazyOwn/security/advisories/GHSA-38jf-j9x7-jf6f",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/grisuno/LazyOwn/security/advisories/GHSA-38jf-j9x7-jf6f",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}