by Kastro
Paper/Archive/CVE-2025-15111

CVE-2025-15111

Ksenia Security S.p.A. lares — Ksenia Security lares Home Automation 1.6 Default Credentials Vulnerability

EPSS 0.6%public exploitCVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 47.5.475 × 209.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Ksenia Security lares (legacy model) version 1.6 contains a default credentials vulnerability that allows unauthorized attackers to gain administrative access. Attackers can exploit the weak default administrative credentials to obtain full control of the home automation system.

Affected

ProductAffectedFixed inSource
lares1.6–CNA
lares1.0.0.15–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitzeroscience.mk/en/vulnerabilities/ZSL-2025-5927.phpexploitpacketstorm.news/files/id/190180refkseniasecurity.comwriteupvulncheck.com/advisories/ksenia-security-lares-home-automation-default-credentials-vulnerability