CVE-2025-15112

Опубликовано: 30 дек. 2025

Источник: nvd

CVSS3: 5.4

EPSS Низкий

Описание

Ksenia Security lares (legacy model) version 1.6 contains a URL redirection vulnerability in the 'cmdOk.xml' script that allows attackers to manipulate the 'redirectPage' GET parameter. Attackers can craft malicious links that redirect authenticated users to arbitrary websites when clicking on a specially constructed link hosted on a trusted domain.

Ссылки

https://packetstorm.news/files/id/190179/
Third Party Advisory
https://www.kseniasecurity.com/
Product
https://www.vulncheck.com/advisories/ksenia-security-lares-home-automation-url-redirection-vulnerability
Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5928.php
Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5928.php
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:kseniasecurity:lares_firmware:1.6:*:*:*:*:*:*:*

cpe:2.3:h:kseniasecurity:lares:4.0:*:*:*:*:*:*:*

EPSS

Процентиль: 15%

0.00238

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-601

Связанные уязвимости

GHSA-x5cr-w4x6-22r9

CVSS3: 8

github

8 месяцев назад

Ksenia Security Lares 4.0 version 1.6 contains a URL redirection vulnerability in the 'cmdOk.xml' script that allows attackers to manipulate the 'redirectPage' GET parameter. Attackers can craft malicious links that redirect authenticated users to arbitrary websites when clicking on a specially constructed link hosted on a trusted domain.

BDU:2026-00330

CVSS3: 4.7

fstec

около 2 лет назад

Уязвимость сценария cmdOk.xml платформы для создания системы «Умный Дом» Lares 4.0, позволяющая нарушителю перенаправить пользователя на произвольный URL-адрес