CVE-2025-15114

9.3 criticalEPSS 0.5%

Critical (9.3) in kseniasecurity lares firmware. EPSS 0.5% chance of exploitation in the next 30 days.

Ksenia Security lares (legacy model) Home Automation version 1.6 contains a critical security flaw that exposes the alarm system PIN in the 'basisInfo' XML file after authentication. Attackers can retrieve the PIN from the server response to bypass security measures and disable the alarm system without additional authentication.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-31)
CWEs: CWE-403, CWE-668
Published: 2025-12-30
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

kseniasecurity:lares_firmware

References

https://www.vulncheck.com/advisories/ksenia-security-lares-home-automation-pin-exposure-vulnerability
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5929.php
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5929.php

Check your stack JSON