ZDI-26-398: (0Day) (Pwn2Own) Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lorex 2K Indoor Wi-Fi Security Cameras. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-15680.
AI Analysis
Technical Summary
The Lorex 2K Indoor Wi-Fi Security Camera contains a format string vulnerability in the sonia binary's JSON request parsing functionality. This vulnerability enables remote code execution by network-adjacent attackers without requiring authentication. The root cause is the lack of proper validation of user-supplied strings before they are used as format specifiers, allowing arbitrary code execution in the context of root. The vulnerability is identified as CVE-2026-15680 with a CVSS score of 7.5. The vendor has been notified and is developing a fix, but as of the advisory date, no official patch has been released. The only recommended mitigation is to limit interaction with the device to trusted parties.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary code with root privileges on affected Lorex 2K Indoor Wi-Fi Security Cameras without authentication. This can lead to full compromise of the device, including confidentiality, integrity, and availability impacts.
Mitigation Recommendations
No official patch or fix is currently available. The vendor is actively working on a fix. Until a patch is released, the primary mitigation is to restrict network interaction with the affected devices to trusted users only. Monitor the vendor advisory for updates on patch availability.
ZDI-26-398: (0Day) (Pwn2Own) Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution Vulnerability
Description
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lorex 2K Indoor Wi-Fi Security Cameras. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-15680.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Lorex 2K Indoor Wi-Fi Security Camera contains a format string vulnerability in the sonia binary's JSON request parsing functionality. This vulnerability enables remote code execution by network-adjacent attackers without requiring authentication. The root cause is the lack of proper validation of user-supplied strings before they are used as format specifiers, allowing arbitrary code execution in the context of root. The vulnerability is identified as CVE-2026-15680 with a CVSS score of 7.5. The vendor has been notified and is developing a fix, but as of the advisory date, no official patch has been released. The only recommended mitigation is to limit interaction with the device to trusted parties.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary code with root privileges on affected Lorex 2K Indoor Wi-Fi Security Cameras without authentication. This can lead to full compromise of the device, including confidentiality, integrity, and availability impacts.
Mitigation Recommendations
No official patch or fix is currently available. The vendor is actively working on a fix. Until a patch is released, the primary mitigation is to restrict network interaction with the affected devices to trusted users only. Monitor the vendor advisory for updates on patch availability.
Technical Details
- Article Source
- {"url":"http://www.zerodayinitiative.com/advisories/ZDI-26-398/","fetched":true,"fetchedAt":"2026-07-09T11:08:34.398Z","wordCount":270}
- Classification
- {"confidence":0.95,"severitySource":"cvss-text","classifier":"rss-v2"}
Threat ID: 6a4f818768715ace4335a9bc
Added to database: 07/09/2026, 11:09:59 UTC
Last enriched: 07/31/2026, 01:44:03 UTC
Last updated: 08/24/2026, 01:41:14 UTC
Views: 104
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.