PT-2025-54261 · Ksenia Security · Ksenia Security Lares

Mencha Isajlovska · Published 2025-12-30 · Updated 2026-03-11 · CVE-2025-15113

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ksenia Security Lares 4.0 Home Automation version 1.6

Description An authenticated attacker can upload MPFS File System binary images through an unprotected endpoint. This allows overwriting flash program memory and potentially executing arbitrary code on the home automation system's web server. The vulnerable endpoint allows file uploads without proper security checks.

Recommendations Apply updates to address the unprotected endpoint in version 1.6.

Exploit

Fix

RCE

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

CWE-256

Related Identifiers

CVE-2025-15113

Affected Products

Ksenia Security Lares

References · 14

• 🔥 https://packetstorm.news/files/id/190178 · Exploit
• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2025-5930.php · Exploit
• https://osv.dev/vulnerability/CVE-2025-15113 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15113 · Security Note
• https://t.me/cveNotify/152507 · Telegram Post
• https://t.me/cveNotify/149394 · Telegram Post
• https://t.me/CVEtracker/41017 · Telegram Post
• https://twitter.com/CVEnew/status/2006332233347686741 · Twitter Post
• https://t.me/cveNotify/147994 · Telegram Post
• https://vulncheck.com/advisories/ksenia-security-lares-home-automation-remote-code-execution-via-mpfs-upload · Note
• https://twitter.com/0dayPublishing/status/2013989015272185934 · Twitter Post
• https://t.me/cveNotify/155170 · Telegram Post
• https://kseniasecurity.com · Note
• https://twitter.com/VulmonFeeds/status/2006241007252263394 · Twitter Post