CRITICAL🇵🇱 Wersja polska

CVE-2025-15114

CVSS 9.3v4.0pub. 2025-12-30upd. 2026-03-11

Ksenia Security lares (legacy model) Home Automation version 1.6 contains a critical security flaw that exposes the alarm system PIN in the 'basisInfo' XML file after authentication. Attackers can retrieve the PIN from the server response to bypass security measures and disable the alarm system without additional authentication.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

After logging into the system, the attacker sends a request to the server, which returns a 'basisInfo' file in XML format containing the alarm system PIN code in plain text. The read PIN can then be used to bypass security measures and deactivate the alarm. The vulnerability is classified as CWE-403 (exposure of protected resource to unauthorized actor) and CWE-668 (exposure of resource to wrong entity).

Impact

An attacker with access to the device's network interface can read the alarm system PIN code and then disable the alarm, which completely neutralizes the physical protection of the facility.

Mitigation & patch

Patches available from the manufacturer should be applied in accordance with the references provided. As interim remedial measures, it is recommended to restrict network access to the device interface exclusively to trusted hosts and to monitor access logs.

Who is affected

Ksenia Security Lares (legacy model) Home Automation version 1.6 (firmware and software).

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X