EUVD-2025-205863

Ksenia Security Lares 4.0 version 1.6 contains a URL redirection vulnerability in the 'cmdOk.xml' script that allows attackers to manipulate the 'redirectPage' GET parameter. Attackers can craft malicious links that redirect authenticated users to arbitrary websites when clicking on a specially...

CVE-2025-15114

CVE-2025-15114 affects Ksenia Security Lares 4.0 Home Automation (v1.6). The root cause is exposure of the alarm PIN in the basisInfo XML response after authentication, allowing an unauthenticated or post-auth access to retrieve the PIN from server responses and bypass security to disable the ala...

CVE-2025-15113 Ksenia Security lares Home Automation 1.6 Remote Code Execution via MPFS Upload

Ksenia Security lares legacy model Home Automation version 1.6 contains an unprotected endpoint vulnerability that allows authenticated attackers to upload MPFS File System binary images. Attackers can exploit this vulnerability to overwrite flash program memory and potentially execute arbitrary...

CVE-2025-15112

Ksenia Security Lares 4.0 Home Automation 1.6 contains a URL redirection vulnerability in the cmdOk.xml script. The issue arises from accepting and manipulating the redirectPage GET parameter, enabling an attacker to craft links that redirect authenticated users to arbitrary websites when the use...

PT-2025-54262

Name of the Vulnerable Software and Affected Versions Ksenia Security Lares 4.0 Home Automation version 1.6 Description A critical security flaw exists that exposes the alarm system PIN in the basisInfo XML file after authentication. An attacker can retrieve the PIN from the server response and...

Ksenia Security Lares 4.0 Home Automation 安全漏洞

Ksenia Security Lares 4.0 Home Automation is an intelligent security and home automation control platform from Ksenia Security, Italy. A security vulnerability exists in Ksenia Security Lares 4.0 Home Automation version 1.6, which stems from the exposure of the alarm system PIN in the baseInfo XM...

Ksenia Security Lares 4.0 Default Credentials

Ksenia Security Lares version 4.0 uses a weak set of default administrative credentials that can be found and used to gain full control of the system. Exploit Title: Ksenia Security Lares 4.0 Home Automation Default Credentials Google Dork: N/A Date: 31 March 2025 Exploit Author: Mencha 'ShadeLoc...

Ksenia Security Lares 4.0 Remote Code Execution

Ksenia Security Lares version 4.0 suffers from a remote code execution vulnerability. Exploit Title: Ksenia Security Lares 4.0 Home Automation Remote Code Execution Google Dork: N/A Date: 31 March 2025 Exploit Author: Mencha 'ShadeLock' Isajlovska Vendor Homepage: https://www.kseniasecurity.com/e...

Ksenia Security Lares WebServer Home Automation Remote Code Execution

Summary Lares is a burglar alarm & home automation system that can be controlled by means of an ergo LCD keyboard, as well as remotely by telephone, and even via the Internet through a built-in WEB server. Description The device provides access to an unprotected endpoint, enabling the upload of...

Ksenia Security Lares WebServer Home Automation Default Credentials

Summary Lares is a burglar alarm & home automation system that can be controlled by means of an ergo LCD keyboard, as well as remotely by telephone, and even via the Internet through a built-in WEB server. Description Ksenia Lares uses a weak set of default administrative credentials that can be...

Ksenia Security Lares WebServer Home Automation URL Redirection

Summary Lares is a burglar alarm & home automation system that can be controlled by means of an ergo LCD keyboard, as well as remotely by telephone, and even via the Internet through a built-in WEB server. Description Input passed via the 'redirectPage' GET parameter in 'cmdOk.xml' script is not...

PT-2025-54259

Name of the Vulnerable Software and Affected Versions Ksenia Security Lares 4.0 Home Automation version 1.6 Description Ksenia Security Lares 4.0 Home Automation version 1.6 has a default credentials issue that allows unauthorized access to administrative functions. Successful exploitation grants...