CVE-2026-68502
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
LazyOwn RedTeam/APT Framework registers an unauthenticated Socket.IO input event handler that dispatches data to a function executing system commands, allowing unauthenticated remote code execution.
Risk Assessment
An attacker can remotely execute arbitrary system commands in the C2 process, potentially leading to full server compromise.
Recommendation
Update to version 0.2.154 or later which fixes this vulnerability.
Original NVD description (English source)
LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches data.get('value') to LazyOwnShell.one_cmd, reaching LazyOwnShell.do_cmd and subprocess.call(command, shell=True), allowing unauthenticated remote code execution in the C2 process. This issue is fixed in 0.2.154.