CVE-2025-15113

Ksenia Security lares (legacy model) Home Automation version 1.6 contains an unprotected endpoint vulnerability that allows authenticated attackers to upload MPFS File System binary images. Attackers can exploit this vulnerability to overwrite flash program memory and potentially execute arbitrary code on the home automation system's web server.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

9.3 CRITICALCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

0.48% chance of exploitation in the next 30 days, 39th percentile

Published

2025-12-30

Updated

2026-03-11

Proof-of-concept exploits (1)

• https://packetstorm.news/files/id/190178/

References

• CVE Record
• NVD entry

Related

• CVE-2025-15112
• CVE-2025-15114
• CVE-2025-15111
• CVE-2025-15116
• CVE-2025-15110
• CVE-2025-15118