CVE-2025-15111

Ksenia Security lares Home Automation 1.6 Default Credentials Vulnerability

State: Published
Severity: 9.3 Critical
Published: Dec 30, 2025
Updated: Mar 11, 2026
Reserved: Dec 27, 2025

Description

Ksenia Security lares (legacy model) version 1.6 contains a default credentials vulnerability that allows unauthorized attackers to gain administrative access. Attackers can exploit the weak default administrative credentials to obtain full control of the home automation system.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-259 Use of hard-coded password

Affected Products

Product	Versions
laresKsenia Security S.p.A.	1.6Affected 1.0.0.15Affected

References

Zero Science Lab Disclosure (ZSL-2025-5927)third-party-advisory
Packet Storm Security Exploit Entryexploit
Ksenia Security Vendor Homepageproduct
https://www.vulncheck.com/advisories/ksenia-security-lares-home-automation-default-credentials-vulnerabilitythird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.