CVE-2025-15111CWE-259

Ksenia Security lares Home Automation 1.6 Default Credentials Vulnerability

Critical · published December 30, 2025

CVSS v4.0
9.3
EPSS
1%
Percentile
46.8
In the wild
Unconfirmed
What it is

🚨 Default credentials are your home’s worst nightmare! The Ksenia Security lares legacy model version 1.6 is still shipping with ‘admin/admin’ credentials, handing attackers the keys to your smart home. 🔥 Think of it like leaving your front door wide open with a sign that says, 'Welcome, please come in!' That's essentially what these default credentials do, inviting unauthorized users into your home automation system without breaking a sweat. An attacker can waltz right in and take full control of your entire home system — adjusting the thermostat, unlocking doors, or even disabling alarms! The implications are absolutely devastating for your privacy and security. Imagine them making changes while you're blissfully unaware.

Put simply

Think of it like leaving your front door wide open with a sign that says, 'Welcome, please come in!' That's essentially what these default credentials do, inviting unauthorized users into your home automation system without breaking a sweat. This vulnerability allows unauthorized access due to the default administrative credentials that users often neglect to change. With these weak credentials, attackers can fully control the home automation system without any authentication barriers.

What to do

An attacker can waltz right in and take full control of your entire home system — adjusting the thermostat, unlocking doors, or even disabling alarms! The implications are absolutely devastating for your privacy and security. Imagine them making changes while you're blissfully unaware. Immediately change the default credentials to strong, unique passwords to lock down access. Ensure that your system is updated to the latest version, and educate all users to follow best practices for securing their credentials. You've got this! Taking these steps will help you safeguard your smart home from unwanted intruders. 🛡️

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00576 · 46.8th percentile
Weakness
CWE-259 · Use of Hard-coded Password
Published
2025-12-30T22:41Z
EPSS history
Timeline
  • 30 DEC 22:41Z
    Ksenia Security lares Home Automation 1.6 Default Credentials Vulnerability
    cvelistv5