PULSE
EN
FEED
ransomwhitearmor reclama a KTU Shipyard · PH · Transportationransomsilentransomgroup reclama a Moritt Hock & Hamroff LLP · US · Professional Servicesransomsilentransomgroup reclama a P...ransomqilin reclama a TRAUCO AG · DE · Manufacturingransomqilin reclama a Honghwa International · TW · Manufacturingransomwallstreet reclama a Suburban Orthopaedics · US · Healthcareransomsilentransomgroup reclama a M... H...ransomrhysida reclama a Cipsa Industrias Sa De Cv · MX · Manufacturingransomqilin reclama a Richland Resources Corporation · US · Energy & Utilitiesransomsilentransomgroup reclama a A... F...ransomqilin reclama a Sistemas Visuales 360 · MX · Technologyransomqilin reclama a Societe Ivoirienne De Telediffusion · CI · Technologyransomqilin reclama a Palletline · GB · Transportationransomaurora reclama a Rapid Manufacturing · Manufacturingransomwhitearmor reclama a KTU Shipyard · PH · Transportationransomsilentransomgroup reclama a Moritt Hock & Hamroff LLP · US · Professional Servicesransomsilentransomgroup reclama a P...ransomqilin reclama a TRAUCO AG · DE · Manufacturingransomqilin reclama a Honghwa International · TW · Manufacturingransomwallstreet reclama a Suburban Orthopaedics · US · Healthcareransomsilentransomgroup reclama a M... H...ransomrhysida reclama a Cipsa Industrias Sa De Cv · MX · Manufacturingransomqilin reclama a Richland Resources Corporation · US · Energy & Utilitiesransomsilentransomgroup reclama a A... F...ransomqilin reclama a Sistemas Visuales 360 · MX · Technologyransomqilin reclama a Societe Ivoirienne De Telediffusion · CI · Technologyransomqilin reclama a Palletline · GB · Transportationransomaurora reclama a Rapid Manufacturing · Manufacturing
← Todos los CVEs
CVE Watch24 oct 2026

CVE-2026-15683

Lorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation Vulnerability. This vulnerability allows netw

CVSS

7.5

Alto

EPSS

0.1%

p4

KEV

—

Exploit Today

1

0-100

Publicado: 13 jul 2026 · Última mod.: 24 oct 2026 · CWE-295

EPSS · 30d
0.1%EPSS · 30 días0.1%
2026-10-022026-10-29
Descripción técnica

Lorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lorex 2K Indoor Wi-Fi Security Cameras. User interaction is not required to exploit this vulnerability. The specific flaw exists within the device management functionality. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-26851.

Referencias oficiales
CVEs relacionados
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1186979.0 CRÍ
—
———In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon trusted compromised intermediate certificates6hCVE-2026-112816—
—
———Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.8hCVE-2026-1195595.9 MED
—
———OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext() implementation that always returns true, attackers can present a non-mTLS host's SNI with a protected Host header to access protected content.7hCVE-2026-92744—
—
——0Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem.6hCVE-2026-1191907.4 ALT
—
——0Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name. Exploitation requires a CA trusted by the application to issue a certificate carrying an attacker-supplied deprecated-OID extension, commonly because the CA copies extensions from a certificate signing request. By placing a permissive deprecated extension before the genuine 2.5.29.19 basicConstraints extension, the certificate holder could have the certificate accepted as a CA and issue certificates for arbitrary names, enabling server or client impersonation. If the issuing CA adds a keyUsage extension without keyCertSign, node-forge rejects the chain. This issue is fixed in version 1.4.1.9hCVE-2026-1191895.9 MED
—
——0Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a path-length-constrained CA without keyUsage that chains to a root trusted by the application, and an attacker who holds that CA's private key or obtains a subordinate CA certificate from it. The attacker could then construct a chain exceeding the declared path length that still passed pki.verifyCertificateChain(). Public web PKI CA certificates normally include keyUsage; private PKIs with CA certificates created without it are more likely to be affected. This issue is fixed in version 1.4.1.9h