Description
LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches data.get('value') to LazyOwnShell.one_cmd, reaching LazyOwnShell.do_cmd and subprocess.call(command, shell=True), allowing unauthenticated remote code execution in the C2 process. This issue is fixed in 0.2.154.
Published: 2026-07-30
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

LazyOwn RedTeam/APT Framework contained an unauthenticated Socket.IO "input" event handler that dispatched the supplied data to a shell command executor without verifying the caller. This omission allowed anyone able to reach the Socket.IO endpoint to execute arbitrary commands on the C2 process, providing complete control over the server hosting LazyOwn.

Affected Systems

The vulnerability affects releases of the LazyOwn framework before version 0.2.154. Products from the vendor grisuno (LazyOwn RedTeam/APT Framework) running those older versions are susceptible.

Risk and Exploitability

The flaw scores a CVSS of 9.8, indicating that exploitation would provide full confidentiality, integrity, and availability compromise. Based on the description, it is inferred that an attacker can trigger the vulnerable event by connecting to the Socket.IO endpoint and sending crafted data. While the EPSS score is very low (< 1%), the lack of authentication makes the vulnerability trivially exploitable for remote attackers. It is not listed in CISA's KEV catalog, yet the high CVSS and open access ensure that the risk remains significant.

Generated by OpenCVE AI on August 2, 2026 at 04:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade LazyOwn to version 0.2.154 or later, which removes the unauthenticated event binding.
  • Reconfigure the C2 environment so that only trusted hosts can connect to the Socket.IO interface—use firewall rules or VPN tunnels to restrict access.
  • Verify that any debugging or development features that expose Socket.IO events are disabled in production deployments.
  • If upgrading is delayed, block the "input" event at the network or application layer until a fix is applied.

Generated by OpenCVE AI on August 2, 2026 at 04:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 02 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Grisuno
Grisuno lazyown
Vendors & Products Grisuno
Grisuno lazyown

Fri, 31 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
Description LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches data.get('value') to LazyOwnShell.one_cmd, reaching LazyOwnShell.do_cmd and subprocess.call(command, shell=True), allowing unauthenticated remote code execution in the C2 process. This issue is fixed in 0.2.154.
Title LazyOwn: Unauthenticated Socket.IO `input` Event Reaches LazyOwn Command Dispatcher — Unauthenticated RCE
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Grisuno Lazyown
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-31T14:07:30.409Z

Reserved: 2026-07-30T16:19:08.081Z

Link: CVE-2026-68502

cve-icon Vulnrichment

Updated: 2026-07-31T14:07:10.138Z

cve-icon NVD

Status : Received

Published: 2026-07-30T21:18:13.317

Modified: 2026-07-31T15:18:01.563

Link: CVE-2026-68502

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T20:34:33Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function