CVE-2025-15114 - CVE House
Back to Database
Status published Critical CVE-2025-15114

Ksenia Security lares Home Automation 1.6 PIN Exposure Vulnerability

Vulnerability Description

Ksenia Security lares (legacy model) Home Automation version 1.6 contains a critical security flaw that exposes the alarm system PIN in the 'basisInfo' XML file after authentication. Attackers can retrieve the PIN from the server response to bypass security measures and disable the alarm system without additional authentication.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-15114

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Mencha Isajlovska

References

More from Ksenia Security S.p.A.

View All →
CVE-2025-15113
Ksenia Security lares Home Automation 1.6 Remote Code Execution via MPFS Upload
Critical 9.3
CVE-2025-15112
Ksenia Security lares Home Automation 1.6 URL Redirection Vulnerability
Medium 5.1
CVE-2025-15111
Ksenia Security lares Home Automation 1.6 Default Credentials Vulnerability
Critical 9.3

Affected Vendor

Ksenia Security S.p.A.

View all reports →

Affected Software

lares
Vulnerable Versions:
1.6, 1.0.0.15

Timeline

Official Publish: December 30th, 2025
Last Modified: March 11th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-403

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.