Stephen Fewer
Today @rapid7 is disclosing the vulnerabilities from our exploit chain targeting the Lorex 2K Indoor Wi-Fi Security Camera, which we entered at this year's Pwn2Own Ireland. A 2 phase exploit, built upon 5 vulnerabilities - phase 1 is an auth bypass, whilst phase 2 is RCE. Read our disclosure here: https://www.rapid7.com/blog/post/2024/12/03/lorex-2k-indoor-wi-fi-security-camera-multiple-vulnerabilities-fixed/