The Lorex 2K Indoor Wi-Fi Security Camera contains a format string vulnerability in the sonia binary's JSON request parsing component. This vulnerability arises from insufficient validation of user-supplied strings used as format specifiers, enabling remote code execution at root privilege level. The vulnerability can be exploited by network-adjacent attackers without requiring authentication. The Zero Day Initiative assigned a CVSS score of 7.5 and disclosed the vulnerability publicly on July 8, 2026. The vendor has acknowledged the issue and is working on a fix, but as of the advisory date, no official patch has been released. The primary mitigation recommended is to restrict interaction with the affected device until a fix is available.

Successful exploitation allows an unauthenticated, network-adjacent attacker to execute arbitrary code with root privileges on the affected Lorex 2K Indoor Wi-Fi Security Camera. This compromises confidentiality, integrity, and availability of the device, potentially enabling full device takeover.

No official patch or fix is currently available. The vendor is working on a remediation. Until a patch is released, the only effective mitigation is to restrict network access and interaction with the affected device to trusted entities only. Monitor the vendor advisory for updates regarding patch availability.