PT-2025-54262 · Ksenia Security · Ksenia Security Lares 4.0 Home Automation

Mencha Isajlovska · Published 2025-12-30 · Updated 2026-03-11 · CVE-2025-15114

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ksenia Security Lares 4.0 Home Automation version 1.6

Description A critical security flaw exists that exposes the alarm system PIN in the basisInfo XML file after authentication. An attacker can retrieve the PIN from the server response and bypass security measures to disable the alarm system without further authentication. The affected system is a home automation system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-403

CWE-668

Related Identifiers

CVE-2025-15114

Affected Products

Ksenia Security Lares 4.0 Home Automation

References · 12

• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2025-5929.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-15114 · Security Note
• https://osv.dev/vulnerability/CVE-2025-15114 · Vendor Advisory
• https://twitter.com/CveFindCom/status/2006148026956419575 · Twitter Post
• https://t.me/cveNotify/152322 · Telegram Post
• https://t.me/cveNotify/155171 · Telegram Post
• https://twitter.com/CVEnew/status/2006332232219374055 · Twitter Post
• https://t.me/CVEtracker/41018 · Telegram Post
• https://twitter.com/TheHackerWire/status/2006145969319018992 · Twitter Post
• https://vulncheck.com/advisories/ksenia-security-lares-home-automation-pin-exposure-vulnerability · Note
• https://twitter.com/VulmonFeeds/status/2006238447481033212 · Twitter Post
• https://twitter.com/0dayPublishing/status/2024131830308319247 · Twitter Post