by Kastro
Paper/Archive/CVE-2025-15113

CVE-2025-15113

Ksenia Security S.p.A. lares — Ksenia Security lares Home Automation 1.6 Remote Code Execution via MPFS Upload

EPSS 0.5%public exploitCVSS 9.3
critical.is priorityof 100
46
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 40.7.407 × 208.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Ksenia Security lares (legacy model) Home Automation version 1.6 contains an unprotected endpoint vulnerability that allows authenticated attackers to upload MPFS File System binary images. Attackers can exploit this vulnerability to overwrite flash program memory and potentially execute arbitrary code on the home automation system's web server.

Affected

ProductAffectedFixed inSource
lares1.6–CNA
lares1.0.0.15–CNA

Scores by source

VulnCheck (CNA)9.3CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitzeroscience.mk/en/vulnerabilities/ZSL-2025-5930.phprefkseniasecurity.comexploitpacketstorm.news/files/id/190178writeupvulncheck.com/advisories/ksenia-security-lares-home-automation-remote-code-execution-via-mpfs-upload