CVE-2025-15114: lares Resource Exposure (CVSS 9.8)

Description

Ksenia Security lares (legacy model) Home Automation version 1.6 contains a critical security flaw that exposes the alarm system PIN in the 'basisInfo' XML file after authentication. Attackers can retrieve the PIN from the server response to bypass security measures and disable the alarm system without additional authentication.

Is your site exposed to CVE-2025-15114?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-403 CWE-403

CWE-668 CWE-668

Affected Products

Vendor	Product	Versions
kseniasecurity	lares_firmware	All
kseniasecurity	lares	All

References

Other References

https://www.vulncheck.com/advisories/ksenia-security-lares-home-automation-pin-exposure-vulnerability https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5929.php https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5929.php

Frequently Asked Questions

What is CVE-2025-15114? +

Ksenia Security lares (legacy model) Home Automation version 1.6 contains a critical security flaw that exposes the alarm system PIN in the 'basisInfo' XML file after authentication. Attackers can retrieve the PIN from the server response to bypass security measures and disable the alarm system without additional authentication. It has a CVSS v3.1 base score of 9.8 (CRITICAL).

How severe is CVE-2025-15114? +

CVE-2025-15114 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.

What products are affected by CVE-2025-15114? +

CVE-2025-15114 affects products from kseniasecurity, specifically: lares, lares_firmware. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-15114? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-58280 8.8

CMSimple 5.15 contains a remote command execution vulnerability that allows authenticated attackers to modify file extensions and upload malicious PHP …

CVE-2026-16526 8.8

A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit …

CVE-2024-21626 8.6

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 …

CVE-2025-3032 7.4

Leaking of file descriptors from the fork server to web content processes could allow for privilege escalation attacks. This vulnerability …

CVE-2025-15111 9.8

Ksenia Security lares (legacy model) version 1.6 contains a default credentials vulnerability that allows unauthorized attackers to gain administrative access. …

CVE-2025-15113 9.3

Ksenia Security lares (legacy model) Home Automation version 1.6 contains an unprotected endpoint vulnerability that allows authenticated attackers to upload …

CVE-2025-15114