{"id":"CVE-2025-15114","state":"PUBLISHED","title":"Ksenia Security lares Home Automation 1.6 PIN Exposure Vulnerability","description":"Ksenia Security lares (legacy model) Home Automation version 1.6 contains a critical security flaw that exposes the alarm system PIN in the 'basisInfo' XML file after authentication. Attackers can retrieve the PIN from the server response to bypass security measures and disable the alarm system without additional authentication.","publishedAt":"2025-12-30T22:41:47.116Z","updatedAt":"2026-03-11T19:29:49.602Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["Ksenia Security S.p.A. lares"],"affected":[{"vendor":"Ksenia Security S.p.A.","product":"lares","defaultStatus":"unknown","versions":[{"version":"1.6","status":"affected"},{"version":"1.0.0.15","status":"affected"}]}],"references":["https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5929.php","https://www.vulncheck.com/advisories/ksenia-security-lares-home-automation-pin-exposure-vulnerability"],"weaknesses":["CWE-403"],"ingestedAt":"2026-10-29T20:08:31.050Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/15xxx/CVE-2025-15114.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-15114","state":"PUBLISHED","datePublished":"2025-12-30T22:41:47.116Z","dateUpdated":"2026-03-11T19:29:49.602Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2025-12-27T01:46:45.375Z"},"containers":{"cna":{"title":"Ksenia Security lares Home Automation 1.6 PIN Exposure Vulnerability","descriptions":[{"lang":"en","value":"Ksenia Security lares (legacy model) Home Automation version 1.6 contains a critical security flaw that exposes the alarm system PIN in the 'basisInfo' XML file after authentication. Attackers can retrieve the PIN from the server response to bypass security measures and disable the alarm system without additional authentication."}],"affected":[{"vendor":"Ksenia Security S.p.A.","product":"lares","defaultStatus":"unknown","versions":[{"version":"1.6","status":"affected"},{"version":"1.0.0.15","status":"affected"}]}],"references":[{"url":"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5929.php","name":"Zero Science Lab Disclosure (ZSL-2025-5929)","tags":["technical-description","exploit"]},{"url":"https://www.vulncheck.com/advisories/ksenia-security-lares-home-automation-pin-exposure-vulnerability","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"CRITICAL","baseScore":9.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"CRITICAL","baseScore":9.8,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-403","lang":"en","description":"CWE-403 Exposure of file descriptor to unintended control sphere ('file descriptor leak')","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-03-11T19:29:49.602Z"},"datePublic":"2025-03-31T00:00:00.000Z","tags":["unsupported-when-assigned"],"credits":[{"lang":"en","value":"Mencha Isajlovska","type":"finder"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5929.php","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-02T14:23:31.058262Z","id":"CVE-2025-15114","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-02T14:38:28.109Z"}}]}}}