CVE-2025-15114
Critical · 9.8CVSS
9.8
EPSS
0.5%
Published
Dec 30, 2025
CISA due date
—
The record
Ksenia Security lares (legacy model) Home Automation version 1.6 contains a critical security flaw that exposes the alarm system PIN in the 'basisInfo' XML file after authentication. Attackers can retrieve the PIN from the server response to bypass security measures and disable the alarm system without additional authentication.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-33263 When mail_max_userip_connections is set (default 10) and reached, submission-login can… CWE-403
- CVE-2026-40042 Pachno 1.0.6 contains an XML external entity injection vulnerability that allows… CWE-403
- CVE-2024-21626 runc is a CLI tool for spawning and running containers on Linux according to the OCI… CWE-403