CVE-2026-15683 Lorex 2K Indoor Wi-Fi Camera Improper Certificate Validation Vulnerability Analysis

Vulnerability Overview Vulnerability Name: (0Day) (Pwn2Own) Lorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation Vulnerability Vulnerability ID: ZDI-26-399 CVE ID: CVE-2026-15683 CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Scope Affected Vendor: Lorex Affected Product: 2K Indoor Wi-Fi Security Camera Remediation Mitigation: Due to the nature of the vulnerability, the only significant mitigation strategy is to restrict interaction with the product. Additional Information Disclosure Timeline: - 2025-05-06: Vulnerability reported to the vendor - 2026-07-08: Coordination for public release recommended - 2026-07-13: Status update provided Credit: PHP Hooligans / Midnight Blue Page Content Vulnerability Details: - This vulnerability allows a network-adjacent attacker to execute arbitrary code on an affected Lorex 2K Indoor Wi-Fi Security Camera installation. User interaction is not required for exploitation. - The specific flaw resides in the device management functionality. The issue stems from the server-provided certificates lacking proper validation. An attacker can leverage this, in combination with other vulnerabilities, to execute code with root privileges. Additional Details: - 2025-06-05: ZDI submitted a report to the vendor - 2025-03-09: ZDI followed up requesting a status update - 2026-12-03: ZDI inquired with the vendor if the issue had been patched in the latest version - 2026-06-25: Vendor communicated that a fix is in progress - 2026-06-26: ZDI notified the vendor of the intention to publish the case as a 0-day - Mitigation: Due to the nature of the vulnerability, the only significant mitigation strategy is to restrict interaction with the product Code Blocks No POC code or exploitation code was included on the page. Summary This vulnerability involves improper certificate validation on the device management server of Lorex 2K Indoor Wi-Fi Security Cameras, allowing a network-adjacent attacker to execute arbitrary code. The mitigation is to restrict interaction with the product.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-15683 Lorex 2K Indoor Wi-Fi Camera Improper Certificate Validation Vulnerability Analysis