CVE-2025-15114

moderate-risk
Published 2025-12-30

Ksenia Security lares (legacy model) Home Automation version 1.6 contains a critical security flaw that exposes the alarm system PIN in the 'basisInfo' XML file after authentication. Attackers can retrieve the PIN from the server response to bypass security measures and disable the alarm system without additional authentication.

Do I need to act?

-
0.05% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Lares Firmware

Affected Vendors

Kseniasecurity

References (3)

Third Party Advisory https://www.vulncheck.com/advisories/ksenia-security-lares-home-automation-pin-e...
Third Party Advisory https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5929.php
Third Party Advisory https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5929.php
37
/ 100
moderate-risk
Severity 32/34 · Critical
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal