CVE-2025-15111

The Ksenia Security Lares home automation system version 1.6 has built-in default login credentials for the administrator account, which are not changed during the configuration process. An attacker, remotely and without any authentication, can use these known credentials to log in to the administrative panel. No user interaction or special network conditions are required – access is possible directly through the network.

An attacker gains full administrative control over the home automation system, allowing them to read, modify, and disrupt the operation of managed devices and processes. The consequence may be compromise of confidentiality, integrity, and availability of the entire system.

Default administrator credentials must be immediately changed to a strong, unique password. Patches available from the manufacturer should be applied in accordance with the provided references, and network access to the administrative panel should be restricted to trusted IP addresses only (e.g., through firewall or network segmentation).

Ksenia Security Lares (legacy model), firmware version 1.6