Ksenia Security Lares Home Automation Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Ksenia Security Lares 4.0 Home Automation version 1.6. This vulnerability arises from an unprotected endpoint that allows authenticated attackers to upload MPFS File System binary images. Exploitation of this vulnerability can lead to overwriting flash program memory, with the potential to execute arbitrary code on the home automation system's web server.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected system.

Reproduction

To reproduce this vulnerability, authenticated attackers can upload MPFS File System binary images through the unprotected endpoint at '/upload'. This action overwrites the flash program memory that contains the web server's main interfaces, potentially leading to arbitrary code execution.