CVE-2025-15113
📋 TL;DR
Ksenia Security Lares 4.0 Home Automation version 1.6 contains an unprotected endpoint that allows authenticated attackers to upload MPFS File System binary images. This enables overwriting flash program memory and potentially executing arbitrary code on the system's web server. Affected users are those running the vulnerable home automation software.
💻 Affected Systems
- Ksenia Security Lares 4.0 Home Automation
📦 What is this software?
Lares Firmware by Kseniasecurity
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary code, take control of the home automation system, pivot to other network devices, and potentially cause physical safety risks.
Likely Case
Remote code execution leading to unauthorized access, data theft, manipulation of home automation controls, and installation of persistent backdoors.
If Mitigated
Limited impact if proper network segmentation and authentication controls prevent access to the vulnerable endpoint.
🎯 Exploit Status
Exploitation requires authentication but is straightforward once authenticated. Public proof-of-concept details are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://www.kseniasecurity.com/
Restart Required: No
Instructions:
No official patch available. Monitor vendor website for updates and apply immediately when released.
🔧 Temporary Workarounds
Network Segmentation
allIsolate the Lares system from untrusted networks and the internet.
Authentication Hardening
allChange default credentials and implement strong authentication policies.
🧯 If You Can't Patch
- Disable or block access to the vulnerable endpoint via firewall rules.
- Implement strict network access controls to limit who can reach the Lares system.
🔍 How to Verify
Check if Vulnerable:
Check if running Ksenia Security Lares 4.0 Home Automation version 1.6. Review system logs for unauthorized MPFS upload attempts.Check Version:
Check system web interface or documentation for version information.Verify Fix Applied:
Verify system is no longer running version 1.6 or that vendor has released and applied a patch.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to MPFS endpoints
- Authentication attempts followed by file uploads
- System reboots or unexpected behavior
Network Indicators:
- HTTP POST requests to MPFS upload endpoints
- Traffic to/from the Lares system from unexpected sources
SIEM Query:
source="lares_system" AND (url="*mpfs*" OR method="POST")🔗 References
- https://packetstorm.news/files/id/190178/
- https://www.kseniasecurity.com/
- https://www.vulncheck.com/advisories/ksenia-security-lares-home-automation-remote-code-execution-via-mpfs-upload
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5930.php
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5930.php
