CVE-2025-15114
📋 TL;DR
This critical vulnerability in Ksenia Security Lares 4.0 Home Automation version 1.6 exposes the alarm system PIN in server responses after authentication. Attackers can retrieve this PIN to bypass security and disable alarm systems without additional authentication. Home and business users of this specific home automation system are affected.
💻 Affected Systems
- Ksenia Security Lares 4.0 Home Automation
📦 What is this software?
Lares Firmware by Kseniasecurity
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain unauthorized access to disable alarm systems, potentially enabling physical intrusion, theft, or safety breaches without detection.
Likely Case
Attackers with network access to the system retrieve the PIN and disable alarms, compromising physical security.
If Mitigated
With proper network segmentation and access controls, only authorized users can reach the vulnerable endpoint, limiting exposure.
🎯 Exploit Status
Exploitation requires authenticated access to retrieve the PIN from the XML response, making it straightforward once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch is available. Monitor vendor channels for updates and apply immediately when released.
🔧 Temporary Workarounds
Restrict Network Access
allLimit access to the home automation system to trusted internal networks only, preventing external exploitation.
Monitor and Block Suspicious Requests
allImplement network monitoring to detect and block repeated requests to the 'basisInfo' endpoint, which may indicate exploitation attempts.
🧯 If You Can't Patch
- Isolate the system on a segmented network with strict firewall rules to prevent unauthorized access.
- Change default credentials and enforce strong authentication to reduce the risk of attackers gaining the initial access needed to exploit this vulnerability.
🔍 How to Verify
Check if Vulnerable:
Authenticate to the system and check if the 'basisInfo' XML file in server responses contains the alarm PIN in plaintext.Check Version:
Check the system interface or documentation for the installed version; it should not be 1.6 if fixed.Verify Fix Applied:
After applying any vendor patch, verify that the PIN is no longer exposed in the 'basisInfo' XML response.📡 Detection & Monitoring
Log Indicators:
- Multiple authentication attempts followed by access to 'basisInfo' endpoint
- Unusual requests to retrieve XML files containing PIN data
Network Indicators:
- Traffic to the home automation system's 'basisInfo' endpoint from untrusted sources
- Patterns of data exfiltration after authentication
SIEM Query:
source_ip IN (untrusted_ips) AND destination_port = [system_port] AND uri CONTAINS 'basisInfo'