Threats affecting pkg:github/grisuno/LazyOwn

CVE-2026-68503 is a critical vulnerability in the LazyOwn RedTeam/APT Framework prior to version 0.2.154. The software shipped with default C2 credentials ('LazyOwn'/'LazyOwn') hardcoded in configuration files and used without change for HTTP Basic authentication. This allows any attacker with network access who knows these default credentials to gain operator-level access to the C2 dashboard. The issue is fixed in version 0.2.154.

CVE-2026-68502 is a critical vulnerability in the LazyOwn RedTeam/APT Framework prior to version 0.2.154. The issue arises from an unauthenticated Socket.IO input event handler in lazyc2.py that allows remote attackers to execute arbitrary commands on the C2 server without authentication. This vulnerability enables unauthenticated remote code execution via the LazyOwnShell command interface. The flaw is fixed in version 0.2.154.