CVE-2025-15114

VENDOR_NAME: Ksenia Security AFFECTED_VERSION: 1.6 MITRE_TACTIC: T1552 — Unsecured Credentials SHODAN_DORKS: ["Ksenia lares", "lares home automation", "basisInfo"] CWE_ID: N/A CVSS_VECTOR: N/A POC_STATUS: None PATCH_DETAILS: UNPATCHED

Executive Summary

CVE-2025-15114 is a critical information disclosure vulnerability in Ksenia Security lares (legacy model) Home Automation version 1.6. The flaw exposes the alarm system PIN inside the 'basisInfo' XML file after authentication, allowing attackers to retrieve the credential directly from the server response. This enables unauthorized bypass of security controls to disable the alarm system. Affected deployments face high risk of physical security compromise with a CVSS score of 9.3. No patches are available and no public exploits have been observed.

Technical Analysis

The vulnerability occurs in Ksenia Security lares Home Automation version 1.6 where the alarm system PIN is stored and returned in the 'basisInfo' XML file following successful authentication. The NVD description states that the PIN is exposed in the server response to the authenticated request for this file. This constitutes an information disclosure issue that reveals sensitive credentials without requiring additional authorization checks. The attack surface is the authenticated session handling of the legacy home automation controller, where the XML response structure includes the PIN in plaintext. No further implementation details such as specific endpoints or parsing logic are provided in the CNA title or NVD description. The mechanism allows direct retrieval of the credential, leading to subsequent abuse of alarm functions.

Exploitation Scenarios

No public PoC available; attack chain is inferred from vulnerability class.
Steps: 1) Reconnaissance/target identification involves locating exposed Ksenia Security lares Home Automation 1.6 instances via network scanning or search engine queries for the product. 2) The specific flaw class is triggered by completing initial authentication to the system, after which the attacker requests the 'basisInfo' XML file. 3) Payload/execution method at the vulnerability-class level consists of parsing the server response to extract the exposed PIN value from the XML content. 4) Post-exploitation impact is the ability to use the retrieved PIN to disable the alarm system without further authentication. The entire chain relies on the credential exposure in the 'basisInfo' XML file after authentication as described in the NVD.

Impact Assessment

Business impact includes complete bypass of physical alarm protections, enabling unauthorized access to protected premises or assets. Affected systems are legacy Ksenia Security lares Home Automation installations running version 1.6. Blast radius extends to any environment relying on the alarm for security, with potential for theft, sabotage, or further lateral movement once the system is disabled. The CVSS score of 9.3 reflects high severity driven by the ease of credential retrieval after authentication and direct impact on security controls. EPSS of 0.00514 places the CVE in the 41.0th percentile of exploited vulnerabilities, indicating low but non-zero exploitation likelihood.

Detection Guidance

Sigma Rule

title: Ksenia Lares PIN Exposure via basisInfo XML
id: 8f4c2e1a-9b3d-4e7f-8c2a-1d5e6f7a8b9c
status: experimental
description: Detects access patterns to basisInfo XML that may expose PIN
logsource:
  product: firewall
  service: http
detection:
  selection:
    http.method: GET
    http.uri|contains: "basisInfo"
  condition: selection
fields:
  - src_ip
  - dst_ip
  - http.uri
level: high

YARA Rule

rule Ksenia_Lares_PIN_Exposure {
    meta:
        description = "Detects references to basisInfo XML in Ksenia lares 1.6"
        author = "valtersit.com"
    strings:
        $xml = "basisInfo"
        $product = "lares"
    condition:
        $xml and $product
}

Suricata IDS Rule

alert http any any -> any any (msg:"Ksenia lares basisInfo XML access - possible PIN exposure"; flow:established,to_server; content:"basisInfo"; http_uri; classtype:web-application-attack; sid:202515114; rev:1;)

Elastic Detection

sequence by source.ip
  [network where destination.port == 80 or destination.port == 443 and url.path like "*basisInfo*"]
  [network where http.response.body.content like "*PIN*"]

Splunk SPL Query

index=firewall OR index=web 
| search uri_path="*basisInfo*" 
| stats count by src_ip, dest_ip, uri_path, _time 
| where count > 0

Wazuh OSSEC Rule

<group name="syslog,authentication,">
  <rule id="100514" level="12">
    <if_sid>550</if_sid>
    <match>basisInfo</match>
    <description>Ksenia lares basisInfo XML access detected - potential PIN exposure (CVE-2025-15114)</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: Restrict network access to the lares controller to trusted management hosts only and monitor all authenticated sessions for 'basisInfo' XML requests. 2) Patch/upgrade steps: No vendor fix or upgrade path is currently available; monitor Ksenia Security advisories for future releases. 3) Long-term hardening: Replace legacy 1.6 installations with supported hardware that does not expose credentials in XML responses and implement network segmentation around alarm controllers.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-15114
Ksenia Security lares Home Automation 1.6 CNA title
No CISA KEV listing
No known threat actor campaigns or exploit-in-the-wild evidence identified
EPSS data from public scoring sources