CVE-2025-15112CWE-601

Ksenia Security lares Home Automation 1.6 URL Redirection Vulnerability

Medium · published December 30, 2025

CVSS v4.0
5.1
EPSS
0%
Percentile
16.8
In the wild
Unconfirmed
What it is

Ksenia Security lares (legacy model) version 1.6 contains a URL redirection vulnerability in the 'cmdOk.xml' script that allows attackers to manipulate the 'redirectPage' GET parameter. Attackers can craft malicious links that redirect authenticated users to arbitrary websites when clicking on a specially constructed link hosted on a trusted domain.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00261 · 16.8th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2025-12-30T22:41Z
EPSS history
Timeline
  • 30 DEC 22:41Z
    Ksenia Security lares Home Automation 1.6 URL Redirection Vulnerability
    cvelistv5