CVE-2025-15113

The record

Ksenia Security lares (legacy model) Home Automation version 1.6 contains an unprotected endpoint vulnerability that allows authenticated attackers to upload MPFS File System binary images. Attackers can exploit this vulnerability to overwrite flash program memory and potentially execute arbitrary code on the home automation system's web server.

Affected packages

Related vulnerabilities

• CVE-2026-19051 Plaintext storage of a password vulnerability in Menulux Software Inc. CWE-256
• CVE-2026-15933 OptimiDoc Server (On-Premise) stores credentials for external services in cleartext. CWE-256
• CVE-2021-38489 HDD password plaintext is stored in a UEFI variable. CWE-256
• CVE-2026-55164 Lemur manages TLS certificate creation. CWE-256
• CVE-2026-14867 Credentials of built-in users are insecurely stored in the User directory of PcVue… CWE-256
• CVE-2026-57302 Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml… CWE-256
• CVE-2026-50268 Steeltoe is an open source project that provides a collection of libraries that helps… CWE-256
• CVE-2024-39575 update_disk_psu_baseline.sh requires password in plain text CWE-256