CVE-2026-15680

Executive Summary

CVE-2026-15680 is a format string vulnerability in the sonia binary of Lorex 2K Indoor Wi-Fi Security Cameras that permits network-adjacent unauthenticated attackers to achieve remote code execution as root. The flaw arises during JSON request parsing where an attacker-supplied string is used directly as a format specifier without validation. Affected devices expose the vulnerability over the local network, enabling arbitrary code execution with full system privileges and no authentication required.

Technical Analysis

The vulnerability resides in the CDeviceOperator component of the sonia binary responsible for handling incoming JSON payloads on the camera's network service. When processing specific fields within the JSON structure, the code passes user-controlled data directly to a printf-style function without a format string argument, triggering CWE-134. This allows an attacker to supply format specifiers such as %n, %s, or %x to read from or write to arbitrary memory locations. The attack surface is the JSON parser exposed on the local network segment, and exploitation succeeds because the process runs with root privileges. No bounds checking or sanitization occurs prior to the format operation, enabling direct control of the instruction pointer or stack contents through repeated specifier abuse.

Exploitation Scenarios

An attacker on the same network segment begins by identifying exposed Lorex cameras via network scanning for open ports associated with the sonia service. The attacker then crafts a malicious JSON request containing a format string payload in the targeted CDeviceOperator field, for example embedding "%n%n%n" sequences to overwrite GOT entries. The payload is transmitted directly to the camera's JSON endpoint, triggering the vulnerable parsing routine and achieving code execution. Successful exploitation spawns a root shell or installs a persistent implant, after which the attacker can exfiltrate video feeds, pivot to other network devices, or deploy ransomware on the camera firmware.

Impact Assessment

Compromise grants root-level control over the camera, allowing live video interception, audio eavesdropping, and lateral movement within the local network. The CVSS 7.5 score reflects high confidentiality, integrity, and availability impact with low attack complexity and no authentication. Blast radius extends to any device sharing the same network segment, potentially exposing corporate IoT deployments or home automation systems to full device takeover and data theft.

Detection Guidance

Sigma Rule

title: Lorex Camera Format String JSON Request
status: experimental
logsource:
  product: suricata
detection:
  selection:
    http.method: 'POST'
    http.uri|contains: '/sonia'
    json.field|contains: '%'
  condition: selection

YARA Rule

rule Lorex_Sonia_FormatString {
    strings:
        $json = /"CDeviceOperator"[^}]*%[nsx]/
        $sonia = "sonia"
    condition:
        $json and $sonia
}

Suricata IDS Rule

alert http any any -> any 80,443 (msg:"Lorex CVE-2026-15680 Format String Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/sonia"; http.request_body; content:"%"; pcre:"/%[0-9]*[nsx]/"; sid:202615680; rev:1;)

Elastic Detection

sequence by source.ip
  [network where destination.port in (80,443) and url.path == "/sonia" and http.request.body.content like "%*%"]

Splunk SPL Query

index=network sourcetype=suricata http_method=POST uri="/sonia" | regex request_body="%[nsx]" | stats count by src_ip

Wazuh OSSEC Rule

<rule id="219400" level="12">
  <if_sid>31101</if_sid>
  <match>%n|%s|%x</match>
  <description>Lorex sonia format string in JSON</description>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: Restrict network access to camera management ports using VLAN segmentation and firewall rules allowing only trusted hosts. Disable UPnP and unnecessary services on the device.
2. Patch/upgrade steps: Monitor vendor firmware releases for Lorex 2K models; apply any future signed updates via the official app once released.
3. Long-term hardening: Replace vulnerable cameras with models supporting authenticated API endpoints and enable TLS client certificate validation on all IoT devices.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-15680 https://www.zerodayinitiative.com/advisories/ZDI-CAN-25884/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15680 No public exploit code or in-the-wild campaigns observed as of current tracking.