CVE-2025-15114
Information Disclosure in Ksenia Lares 4.0 Exposes Alarm PIN
Publication date: 2025-12-30
Last updated on: 2026-03-11
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ksenia_security | lares | 4.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-403 | A process does not close sensitive file descriptors before invoking a child process, which allows the child to perform unauthorized I/O operations using those descriptors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Ksenia Security Lares 4.0 Home Automation version 1.6, where the alarm system PIN is exposed in the 'basisInfo' XML file after authentication. Attackers can retrieve this PIN from the server response, allowing them to bypass security measures and disable the alarm system without needing any additional authentication.
How can this vulnerability impact me? :
The vulnerability allows attackers to obtain the alarm system PIN and disable the alarm without further authentication. This can lead to unauthorized access and control over the security system, potentially compromising the safety and security of the premises protected by the alarm.