CVE-2026-15680: Lorex 2K Wi-Fi Camera RCE Vulnerability

CVE-2026-15680 Overview

CVE-2026-15680 is a format string vulnerability [CWE-134] in the Lorex 2K Indoor Wi-Fi Security Camera. The flaw resides in the CDeviceOperator JSON request handler within the sonia binary. Network-adjacent attackers can execute arbitrary code as root without authentication. The Zero Day Initiative tracks this issue as ZDI-CAN-25884 and published advisory ZDI-26-398.

Critical Impact
Unauthenticated attackers on the same network segment can achieve root-level remote code execution on affected cameras, enabling full device takeover, surveillance interception, and lateral movement into the victim network.

Affected Products

Lorex 2K Indoor Wi-Fi Security Camera
Camera firmware containing the vulnerable sonia binary
Deployments exposing the camera management service on the local network

Discovery Timeline

2026-07-13 - CVE-2026-15680 published to the National Vulnerability Database (NVD)
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15680

Vulnerability Analysis

The vulnerability exists in the JSON request parsing logic of the sonia binary, which handles device operations on the Lorex 2K Indoor Wi-Fi Security Camera. A user-supplied string from an inbound JSON request reaches a formatted output function without sanitization. Because the attacker controls the format specifier, they can read from and write to arbitrary memory locations. The sonia process runs as root, so successful exploitation results in code execution with the highest privilege level on the device.

Exploitation requires network adjacency, meaning the attacker must reside on the same Wi-Fi segment or a routed local network. Authentication is not required. The attack complexity is elevated because format string exploitation against a hardened embedded target typically requires memory layout knowledge or an information-leak primitive derived from the same flaw.

Root Cause

The root cause is improper use of a formatted output function [CWE-134]. The CDeviceOperator code path passes attacker-controlled JSON field data directly as the format argument rather than as a variadic value. Format specifiers such as %s, %n, and %x are interpreted against the process stack, enabling memory disclosure and arbitrary write primitives.

Attack Vector

An attacker joins the local network hosting the camera and sends a crafted JSON request containing format specifiers within a string field consumed by CDeviceOperator. The vulnerable code passes the value to a printf-family function. Repeated requests allow the attacker to leak stack addresses, defeat address-space layout randomization on the target, and stage a write primitive to hijack control flow. Because no authentication check gates the endpoint, exploitation proceeds without valid credentials.

No public proof-of-concept code is available. Refer to Zero Day Initiative Advisory ZDI-26-398 for additional technical details.

Detection Methods for CVE-2026-15680

Indicators of Compromise

Inbound JSON payloads to the camera management service containing format specifier tokens such as %s, %n, %x, or %p inside string fields
Unexpected crashes, restarts, or watchdog resets of the sonia process visible in device logs or via syslog forwarding
New outbound connections from the camera to non-vendor infrastructure, including reverse shells or DNS callbacks
Configuration changes on the camera that were not initiated by an administrator

Detection Strategies

Inspect network traffic destined for Lorex cameras and alert on JSON keys whose values contain printf-style format tokens
Baseline expected outbound destinations for each camera and flag deviations that indicate command-and-control activity
Monitor for repeated malformed requests from a single source, which suggests format string offset probing

Monitoring Recommendations

Forward camera syslog output to a centralized logging platform and retain crash and process-restart events
Segment IoT cameras onto an isolated VLAN and monitor east-west traffic between clients and the camera management port
Track authentication and administrative API calls against Lorex devices for anomalous activity patterns

How to Mitigate CVE-2026-15680

Immediate Actions Required

Restrict network access to affected Lorex cameras so only trusted management hosts can reach the device
Place cameras on a dedicated VLAN with no route to sensitive corporate assets or the internet
Disable remote administration features that expose the sonia service beyond the local subnet
Audit existing camera deployments for unauthorized configuration changes or unknown outbound connections

Patch Information

No vendor patch is referenced in the available advisory data. Monitor the Zero Day Initiative Advisory ZDI-26-398 and the Lorex support portal for firmware updates addressing CVE-2026-15680. Apply firmware updates as soon as they are released.

Workarounds

Enforce strict network segmentation using firewall rules that block untrusted hosts from reaching the camera management port
Require VPN access for any remote administration of camera infrastructure
Disable Wi-Fi guest network bridging that would place untrusted clients on the same segment as the cameras
Decommission or replace affected cameras in high-risk environments until a firmware fix is available

bash

# Example iptables rule restricting camera access to a management host
iptables -A FORWARD -s 192.168.50.10 -d 192.168.20.0/24 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 192.168.20.0/24 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 192.168.20.0/24 -j DROP