What is CVE-2026-15680?

CVE-2026-15680 is a high-severity vulnerability in Lorex 2k Indoor Wi-Fi Security Camera, classified under Use of Externally-Controlled Format String. CVSS score: 7.5/10. Published 2026-07-13.

How severe is CVE-2026-15680?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Lorex 2k Indoor Wi-Fi Security Camera

CVE-2026-15680

Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lorex 2K Indoor Wi-Fi Security Cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of JSON requests in the sonia binary. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-25884.

EPSS: 0.004 (33.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Lorex 2k Indoor Wi-fi Security Camera — versions 2.800.020000000.3.R.20220331

Weakness classification (CWE)

CWE-134 — Use of Externally-Controlled Format String

References

zdi-disclosures@trendmicro.com (x_research-advisory)

Frequently asked questions

What is CVE-2026-15680?: CVE-2026-15680 is a high-severity vulnerability in Lorex 2k Indoor Wi-Fi Security Camera, classified under Use of Externally-Controlled Format String. CVSS score: 7.5/10. Published 2026-07-13.
How severe is CVE-2026-15680?: High severity. CVSS v3 base score is 7.5 out of 10.