LazyOwn, an AI‑powered C2 framework, shipped default HTTP Basic authentication credentials (username LazyOwn, password LazyOwn) in payload configuration files and code before version 0.2.154. An attacker who can reach the C2 dashboard over the network and knows these defaults can authenticate as a C2 operator, gaining full administrative control. This flaw allows non‑authenticated users to bypass any intended access controls, resultin g complete compromise of the C2 environment.

The vulnerability affects any installation of the LazyOwn RedTeam/APT Framework released prior to 0.2.154. Authenticated operators could use the default credentials listed in payload.json and core/payload_schema.py. There is no version information beyond the release note that 0.2.154 fixes the issue, so all earlier releases remain impacted.

The CVSS score of 9.8 classifies it as Critical, with an attack vector inferred to be local network reachability to the C2 HTTP service. Exploitability is high: the attacker needs only to obtain the default credentials, which are openly shipped and therefore trivially known. The EPSS score of 0.00395 indicates a very low but non‑zero exploitation probability, and the vulnerability is not yet listed in the CISA KEV catalog. Despite the low EPSS, its critical severity and ease of exploitation make it a high‑priority threat.