CVE-2025-15112
Ksenia Security lares Home Automation 1.6 URL Redirection Vulnerability
- State
- Published
- Severity
- 5.1 Medium
- Published
- Dec 30, 2025
- Updated
- Mar 11, 2026
- Reserved
- Dec 27, 2025
Description
Ksenia Security lares (legacy model) version 1.6 contains a URL redirection vulnerability in the 'cmdOk.xml' script that allows attackers to manipulate the 'redirectPage' GET parameter. Attackers can craft malicious links that redirect authenticated users to arbitrary websites when clicking on a specially constructed link hosted on a trusted domain.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N | VulnCheck |
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-601 URL redirection to untrusted site ('open redirect')
Affected Products
| Product | Versions |
|---|---|
laresKsenia Security S.p.A. |
|
References
- Zero Science Lab Disclosure (ZSL-2025-5928)third-party-advisory
- Packet Storm Security Exploit Entryexploit
- Ksenia Security Vendor Homepageproduct
- https://www.vulncheck.com/advisories/ksenia-security-lares-home-automation-url-redirection-vulnerabilitythird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.