CVE-2025-15111 is a critical default credentials vulnerability affecting Ksenia Security lares (legacy model) version 1.6 and its firmware. This flaw allows unauthorized attackers to gain full administrative control over the home automation system due to weak, easily exploitable default credentials. With a CVSS score of 9.8 (CRITICAL), this vulnerability is remotely exploitable with low attack complexity and no user interaction required, leading to complete compromise of confidentiality, integrity, and availability. Its FAUCET Risk Score is 97/100, indicating a very high potential impact. While not currently listed in CISA's KEV catalog or having public exploit code in Metasploit, Nuclei, or ExploitDB, the vulnerability has garnered significant community discussion with 11 mentions, placing it in the top 1% of all CVEs for community attention. Its EPSS score is low, suggesting a low probability of exploitation in the wild at present.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.6CPE matchmatch criteria | cpe:2.3:o:kseniasecurity:lares_firmware:1.6:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.