The vulnerability resides in the sonia binary’s handling of JSON payloads. When a user‑supplied string is incorporated as a format specifier without proper validation, a printf‑like interpreter processes it, allowing an attacker to inject arbitrary format specifiers and execute code with root privileges. This classic Format String flaw (CWE‑134) grants the attacker full control over the camera system.

Lorex 2K Indoor Wi‑Fi Security Camera units that run the sonia firmware are potentially affected; no specific version ranges were disclosed by the vendor, but the issue exists in the sonia binary handling JSON requests within the product line.

The CVSS score of 7.5 reflects high severity, and authentication is not required—an attacker only needs network adjacency, typical on a local network or a compromised Wi‑Fi client. The EPSS score is < 1 %, indicating a low but nonzero probability of exploitation; however, the lack of authentication keeps exploitation potential high. The vulnerability is not yet listed in the CISA KEV catalog. An attacker can send a malformed JSON request to the sonia service from a nearby device and trigger arbitrary code execution as root, allowing full control of the camera, data exfiltration, or pivoting into the network.