Headline
Ksenia Security Lares 4.0 Home Automation Remote Code Execution
The device provides access to an unprotected endpoint, enabling the upload of MPFS File System binary images. Authenticated attackers can exploit this vulnerability to overwrite the flash program memory containing the web server’s main interfaces, potentially leading to arbitrary code execution.
Title: Ksenia Security Lares 4.0 Home Automation Remote Code Execution
Advisory ID: ZSL-2025-5930
Type: Local/Remote
Impact: System Access, DoS
Risk: (4/5)
Release Date: 31.03.2025
Summary
Lares is a burglar alarm & home automation system that can be controlled by means of an ergo LCD keyboard, as well as remotely by telephone, and even via the Internet through a built-in WEB server.
Description
The device provides access to an unprotected endpoint, enabling the upload of MPFS File System binary images. Authenticated attackers can exploit this vulnerability to overwrite the flash program memory containing the web server’s main interfaces, potentially leading to arbitrary code execution.
Vendor
Ksenia Security S.p.A. - https://www.kseniasecurity.com
Affected Version
Firmware version 1.6
Webserver version 1.0.0.15
Tested On
Ksenia Lares Webserver
Vendor Status
[03.07.2024] Vulnerability discovered.
[27.09.2024] Vendor contacted.
[30.03.2025] No response from the vendor.
[31.03.2025] Public security advisory released.
PoC
ksenia_rce.txt
Credits
Vulnerability discovered by Mencha Isajlovska - <shadelock@zeroscience.mk>
References
[1] https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5796.php
[2] https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5799.php
[3] https://packetstorm.news/files/id/190178/
Changelog
[31.03.2025] - Initial release
[03.04.2025] - Added reference [3]
Contact
Zero Science Lab
Web: https://www.zeroscience.mk
e-mail: lab@zeroscience.mk