CVE-2019-25241

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-25241
FaceSentry Access Control System 6.4.8 contains a critical authentication vulnerability with hard-coded SSH credentials for the wwwuser account. Attackers can leverage the insecure sudoers configuration to escalate privileges and gain root access by executing sudo commands without authentication.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://www.iwt.com.hk Product
https://www.exploit-db.com/exploits/47067 Exploit Third Party Advisory VDB Entry
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5526.php Exploit Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5526.php Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:iwt:facesentry_access_control_system_firmware:5.7.0:*:*:*:*:*:*:*
cpe:2.3:h:iwt:facesentry_access_control_system:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:iwt:facesentry_access_control_system_firmware:5.7.2:*:*:*:*:*:*:*
cpe:2.3:h:iwt:facesentry_access_control_system:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:iwt:facesentry_access_control_system_firmware:6.4.8:*:*:*:*:*:*:*
cpe:2.3:h:iwt:facesentry_access_control_system:-:*:*:*:*:*:*:*
History

31 Dec 2025, 14:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 7.5 		v2 : unknown
v3 : 9.8

30 Dec 2025, 20:14

Type Values Removed Values Added
References () http://www.iwt.com.hk - () http://www.iwt.com.hk - Product
References () https://www.exploit-db.com/exploits/47067 - () https://www.exploit-db.com/exploits/47067 - Exploit, Third Party Advisory, VDB Entry
References () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5526.php - () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5526.php - Exploit, Third Party Advisory
CPE cpe:2.3:o:iwt:facesentry_access_control_system_firmware:6.4.8:*:*:*:*:*:*:*
cpe:2.3:h:iwt:facesentry_access_control_system:-:*:*:*:*:*:*:*
cpe:2.3:o:iwt:facesentry_access_control_system_firmware:5.7.2:*:*:*:*:*:*:*
cpe:2.3:o:iwt:facesentry_access_control_system_firmware:5.7.0:*:*:*:*:*:*:*
First Time Iwt facesentry Access Control System
Iwt
Iwt facesentry Access Control System Firmware

24 Dec 2025, 21:16

Type Values Removed Values Added
References () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5526.php - () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5526.php -

24 Dec 2025, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-12-24 20:15

Updated : 2025-12-31 14:15

NVD link : CVE-2019-25241

Mitre link : CVE-2019-25241

CVE.ORG link : CVE-2019-25241

JSON object : View

Products Affected

iwt

  • facesentry_access_control_system
  • facesentry_access_control_system_firmware
CWE
CWE-798

Use of Hard-coded Credentials