CVE-2025-15114

critical · 9.3

Ksenia Security lares (legacy model) Home Automation version 1.6 contains a critical security flaw that exposes the alarm system PIN in the 'basisInfo' XML file after authentication. Attackers can retrieve the PIN from the server response to bypass security measures and disable the alarm system without additional authentication.

9.3

CVSS

0.6%

EPSS (exploit prob.)

45th

EPSS percentile

2025-12-30

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-403CWE-668

Affected products

Vendor	Product	Affected versions
kseniasecurity	lares_firmware	1.6
kseniasecurity	lares	4.0

Check a specific version with /api/v1/cve/match.

References

https://www.vulncheck.com/advisories/ksenia-security-lares-home-automation-pin-exposure-vulnerability
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5929.php
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5929.php

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-15114