What is the CVSS score of CVE-2026-15680?

CVE-2026-15680 has a CVSS 3.0 base score of 7.5 (High). CVSS vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Lorex 2K Camera are affected by CVE-2026-15680?

Lorex 2K Indoor Wi-Fi Security Cameras contain a critical remote code execution vulnerability (CVE-2026-15680) that allows network-adjacent attackers to gain complete device control without…

How to fix or mitigate CVE-2026-15680?

Within 24 hours, conduct a complete inventory of all Lorex 2K Indoor Wi-Fi cameras across the organization and immediately isolate them to a dedicated restricted network segment or disable non-critical units until mitigation is in place. Within 7 days, implement firewall rules limiting camera management access to essential networks only, deploy network monitoring to detect suspicious activity on affected devices, and subscribe to ZDI and Lorex security advisories for patch announcements. Within 30 days, apply the vendor patch immediately upon release; if Lorex has not released a patch within 60 days, develop and execute a phased camera replacement plan to eliminate exposure.

Lorex 2K Camera CVE-2026-15680

HIGH

Use of Externally-Controlled Format String (CWE-134)

2026-07-13 zdi

RCE 2K Indoor Wi Fi Security Camera

7.5

CVSS 3.0 · Vendor: zdi

Severity by source

Vendor (zdi) PRIMARY

7.5 HIGH

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Adjacent-network reach (AV:A) and no auth (PR:N) match the flaw; format-string exploitation is non-trivial (AC:H); code exec as root yields full C:H/I:H/A:H with scope unchanged.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (zdi).

CVSS VectorVendor: zdi

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 22:10 vuln.today

CVE Published

Jul 13, 2026 - 21:32 cve.org

HIGH 7.5

DescriptionCVE.org

Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lorex 2K Indoor Wi-Fi Security Cameras. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the parsing of JSON requests in the sonia binary. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-25884.

AnalysisAI

Remote code execution in the Lorex 2K Indoor Wi-Fi Security Camera lets a network-adjacent, unauthenticated attacker run arbitrary code as root by abusing a CWE-134 format string flaw in the camera's 'sonia' binary. A user-supplied string within a JSON request is passed directly into a format specifier by the CDeviceOperator component, giving full device takeover. Discovered and reported through ZDI (ZDI-26-398 / ZDI-CAN-25884); no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability lives in the 'sonia' service binary that handles JSON request parsing on Lorex 2K Indoor Wi-Fi cameras - a Linux-based embedded IoT device where privileged services commonly run as root. The root cause is CWE-134 (Use of Externally-Controlled Format String): attacker-controlled input from a JSON field is handed to a C printf-family function (e.g. printf/sprintf/syslog) as the format argument rather than as data. Format specifiers such as %n, %x, and %s then let an attacker read from and write to process memory, which can be chained into control-flow hijacking and arbitrary code execution. The affected CPE is cpe:2.3:a:lorex:2k_indoor_wi-fi_security_camera, and the CDeviceOperator handler is the specific code path exercised.

RemediationAI

No vendor-released patch identified at time of analysis; the provided data contains only the ZDI advisory (https://www.zerodayinitiative.com/advisories/ZDI-26-398/) with no fixed firmware version, so check Lorex's support portal for firmware updates for the 2K Indoor Wi-Fi camera and apply them once published. Because the attack requires network-adjacent access, the strongest compensating control is network isolation: place the camera on a dedicated VLAN or IoT SSID with no lateral reachability to trusted hosts and no inbound access from untrusted Wi-Fi clients (trade-off: legitimate app/NVR access must be explicitly allowed through the segment). Restrict who can associate to the same Wi-Fi network the camera uses (strong WPA2/WPA3, no guest bridging) and block the camera's management/streaming ports from all but authorized controllers, accepting that this may break third-party integrations. Disabling remote/cloud access and monitoring the camera's service ports for anomalous JSON traffic further reduces exposure until a firmware fix is available.