Lorex 2K Camera CVE-2026-15683
HIGHSeverity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent MitM position needed (AV:A) and success depends on winning interception and chaining other bugs (AC:H); no auth or interaction, yielding root-level code execution (C/I/A:H).
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
2DescriptionCVE.org
Lorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lorex 2K Indoor Wi-Fi Security Cameras. User interaction is not required to exploit this vulnerability.
The specific flaw exists within the device management functionality. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-26851.
AnalysisAI
Remote code execution affects the Lorex 2K Indoor Wi-Fi Security Camera through improper TLS certificate validation in its device management server, allowing a network-adjacent attacker to impersonate the management server and, when chained with additional flaws, run code as root without any user interaction. The issue was reported through Trend Micro's Zero Day Initiative (ZDI-26-399, formerly ZDI-CAN-26851). There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Technical ContextAI
The vulnerability is rooted in CWE-295 (Improper Certificate Validation). The camera's device management functionality establishes a connection to a management server but fails to properly validate the X.509 certificate the server presents, meaning a forged or attacker-controlled certificate is accepted as trusted. This breaks the authentication guarantee of TLS, enabling an adjacent attacker to sit between the camera and its legitimate management endpoint (a classic machine-in-the-middle position) and feed the device malicious responses. Per the affected CPE (cpe:2.3:a:lorex:2k_indoor_wi-fi_security_camera), this is the application/firmware layer of a consumer IoT Wi-Fi camera, where the management channel is a trusted control path - subverting it gives the attacker influence over privileged device operations.
RemediationAI
No vendor-released patch version is identified in the available data, so a specific firmware upgrade target cannot be cited; monitor Lorex's support/security page and the ZDI advisory (https://www.zerodayinitiative.com/advisories/ZDI-26-399/) for a patched firmware release and apply it as the primary fix once available. As compensating controls, isolate the camera on a dedicated VLAN or guest/IoT network segment so no untrusted device shares its broadcast domain (removing the adjacent-network foothold the attack requires), which has the trade-off of complicating access from the primary LAN and may require firewall rules for the mobile app. Restrict and monitor Layer 2 access on the wireless network (enable wireless client isolation, use WPA3, and watch for ARP spoofing/MitM activity) to make the machine-in-the-middle position harder to obtain; client isolation may break local peer-to-peer streaming features. Because the flaw involves the device trusting a forged management-server certificate, blocking or tightly controlling the camera's outbound management traffic to only known-good endpoints reduces the opportunity for redirection, at the cost of potentially disrupting cloud management functions.
Same weakness CWE-295 – Improper Certificate Validation
View allShare
External POC / Exploit Code
Leaving vuln.today