CVE-2026-68503
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
LazyOwn RedTeam/APT Framework ships default C2 credentials in configuration files, allowing any network-reachable attacker to authenticate to the C2 dashboard with operator-level access.
Risk Assessment
An unauthenticated attacker can take control of the C2 framework, potentially leading to full compromise of the red team environment.
Recommendation
Change default credentials before deployment and update to version 0.2.154 or later.
Original NVD description (English source)
LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and core/payload_schema.py and passes them unchanged to lazyc2.py HTTP Basic authentication, allowing any network-reachable attacker who knows the defaults to authenticate to the C2 dashboard with operator-level access. This issue is fixed in 0.2.154.