Title: Ksenia Security Lares 4.0 Home Automation Remote Code Execution
Advisory ID: ZSL-2025-5930
Type: Local/Remote
Impact: System Access, DoS
Risk: (4/5)
Release Date: 31.03.2025

Summary

Lares is a burglar alarm & home automation system that can be controlled by means of an ergo LCD keyboard, as well as remotely by telephone, and even via the Internet through a built-in WEB server.

Description

The device provides access to an unprotected endpoint, enabling the upload of MPFS File System binary images. Authenticated attackers can exploit this vulnerability to overwrite the flash program memory containing the web server's main interfaces, potentially leading to arbitrary code execution.

Vendor

Ksenia Security S.p.A. - https://www.kseniasecurity.com

Affected Version

Firmware version 1.6
Webserver version 1.0.0.15

Tested On

Ksenia Lares Webserver

Vendor Status

[03.07.2024] Vulnerability discovered.
[27.09.2024] Vendor contacted.
[30.03.2025] No response from the vendor.
[31.03.2025] Public security advisory released.

PoC

ksenia_rce.txt

Credits

Vulnerability discovered by Mencha Isajlovska - <shadelock@zeroscience.mk>

References

[1] https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5796.php
[2] https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5799.php
[3] https://packetstorm.news/files/id/190178/

Changelog

[31.03.2025] - Initial release
[03.04.2025] - Added reference [3]

Contact

Zero Science Lab

Web: https://www.zeroscience.mk
e-mail: lab@zeroscience.mk