CVE-2026-68503

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68503", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-30T16:19:08.081Z", "datePublished": "2026-07-30T20:39:34.763Z", "dateUpdated": "2026-07-31T15:59:00.803Z"}, "containers": {"cna": {"title": "LazyOwn: Default C2 Operator Credentials Enable Administrative Access to C2 Dashboard", "problemTypes": [{"descriptions": [{"cweId": "CWE-1392", "lang": "en", "description": "CWE-1392: Use of Default Credentials", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/grisuno/LazyOwn/security/advisories/GHSA-38jf-j9x7-jf6f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/grisuno/LazyOwn/security/advisories/GHSA-38jf-j9x7-jf6f"}, {"name": "https://github.com/grisuno/LazyOwn/commit/2e1e3a7b5da8149ae28a970b5883aefa42921652", "tags": ["x_refsource_MISC"], "url": "https://github.com/grisuno/LazyOwn/commit/2e1e3a7b5da8149ae28a970b5883aefa42921652"}, {"name": "https://github.com/grisuno/LazyOwn/releases/tag/release/0.2.154", "tags": ["x_refsource_MISC"], "url": "https://github.com/grisuno/LazyOwn/releases/tag/release/0.2.154"}], "affected": [{"vendor": "grisuno", "product": "LazyOwn", "versions": [{"version": "< 0.2.154", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-30T20:39:34.763Z"}, "descriptions": [{"lang": "en", "value": "LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and core/payload_schema.py and passes them unchanged to lazyc2.py HTTP Basic authentication, allowing any network-reachable attacker who knows the defaults to authenticate to the C2 dashboard with operator-level access. This issue is fixed in 0.2.154."}], "source": {"advisory": "GHSA-38jf-j9x7-jf6f", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/grisuno/LazyOwn/security/advisories/GHSA-38jf-j9x7-jf6f", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-31T15:54:10.999458Z", "id": "CVE-2026-68503", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-31T15:59:00.803Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-68503", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-31T15:54:10.999458Z"}}}], "references": [{"url": "https://github.com/grisuno/LazyOwn/security/advisories/GHSA-38jf-j9x7-jf6f", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-31T15:54:21.164Z"}}], "cna": {"title": "LazyOwn: Default C2 Operator Credentials Enable Administrative Access to C2 Dashboard", "source": {"advisory": "GHSA-38jf-j9x7-jf6f", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "grisuno", "product": "LazyOwn", "versions": [{"status": "affected", "version": "< 0.2.154"}]}], "references": [{"url": "https://github.com/grisuno/LazyOwn/security/advisories/GHSA-38jf-j9x7-jf6f", "name": "https://github.com/grisuno/LazyOwn/security/advisories/GHSA-38jf-j9x7-jf6f", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/grisuno/LazyOwn/commit/2e1e3a7b5da8149ae28a970b5883aefa42921652", "name": "https://github.com/grisuno/LazyOwn/commit/2e1e3a7b5da8149ae28a970b5883aefa42921652", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/grisuno/LazyOwn/releases/tag/release/0.2.154", "name": "https://github.com/grisuno/LazyOwn/releases/tag/release/0.2.154", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and core/payload_schema.py and passes them unchanged to lazyc2.py HTTP Basic authentication, allowing any network-reachable attacker who knows the defaults to authenticate to the C2 dashboard with operator-level access. This issue is fixed in 0.2.154."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1392", "description": "CWE-1392: Use of Default Credentials"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-30T20:39:34.763Z"}}}, "cveMetadata": {"cveId": "CVE-2026-68503", "state": "PUBLISHED", "dateUpdated": "2026-07-31T15:59:00.803Z", "dateReserved": "2026-07-30T16:19:08.081Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-30T20:39:34.763Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "LazyOwn", "vendor": "grisuno", "versions": [{"status": "affected", "version": "< 0.2.154"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and core/payload_schema.py and passes them unchanged to lazyc2.py HTTP Basic authentication, allowing any network-reachable attacker who knows the defaults to authenticate to the C2 dashboard with operator-level access. This issue is fixed in 0.2.154."}, {"lang": "es", "value": "LazyOwn RedTeam/APT Framework es un framework impulsado por IA para C2 y operaciones de equipo rojo. Antes de la versi\u00f3n 0.2.154, LazyOwn inclu\u00eda credenciales C2 predeterminadas LazyOwn y LazyOwn en payload.json y core/payload_schema.py, y las pasaba sin cambios a la autenticaci\u00f3n b\u00e1sica HTTP de lazyc2.py, permitiendo a cualquier atacante accesible por red que conociera los valores predeterminados autenticarse en el panel de control del C2 con acceso de nivel de operador. Este problema est\u00e1 solucionado en la versi\u00f3n 0.2.154."}], "id": "CVE-2026-68503", "lastModified": "2026-10-23T22:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-68503", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-31T15:54:10.999458Z", "version": "2.0.3"}}]}, "published": "2026-07-30T21:18:13.460", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/grisuno/LazyOwn/commit/2e1e3a7b5da8149ae28a970b5883aefa42921652"}, {"source": "security-advisories@github.com", "url": "https://github.com/grisuno/LazyOwn/releases/tag/release/0.2.154"}, {"source": "security-advisories@github.com", "url": "https://github.com/grisuno/LazyOwn/security/advisories/GHSA-38jf-j9x7-jf6f"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/grisuno/LazyOwn/security/advisories/GHSA-38jf-j9x7-jf6f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1392"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.2.154)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "LazyOwn", "source": "cna", "vendor": "grisuno"}, "product": "lazyown", "vendor": "grisuno"}], "created": "2026-07-31T19:30:04.189294+00:00", "updated": "2026-08-04T11:45:03.800168+00:00", "vendors": ["grisuno", "grisuno$PRODUCT$lazyown"]}