CVE-2019-25242

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-25242
FaceSentry Access Control System 6.4.8 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to change administrator passwords, add new admin users, or open access control doors by tricking authenticated users into loading a specially crafted webpage.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
http://www.iwt.com.hk Product
https://www.exploit-db.com/exploits/47065 Exploit Third Party Advisory VDB Entry
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5524.php Exploit Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5524.php Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:iwt:facesentry_access_control_system_firmware:5.7.0:*:*:*:*:*:*:*
cpe:2.3:h:iwt:facesentry_access_control_system:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:iwt:facesentry_access_control_system_firmware:5.7.2:*:*:*:*:*:*:*
cpe:2.3:h:iwt:facesentry_access_control_system:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:iwt:facesentry_access_control_system_firmware:6.4.8:*:*:*:*:*:*:*
cpe:2.3:h:iwt:facesentry_access_control_system:-:*:*:*:*:*:*:*
History

30 Dec 2025, 20:14

Type Values Removed Values Added
CPE cpe:2.3:o:iwt:facesentry_access_control_system_firmware:6.4.8:*:*:*:*:*:*:*
cpe:2.3:h:iwt:facesentry_access_control_system:-:*:*:*:*:*:*:*
cpe:2.3:o:iwt:facesentry_access_control_system_firmware:5.7.2:*:*:*:*:*:*:*
cpe:2.3:o:iwt:facesentry_access_control_system_firmware:5.7.0:*:*:*:*:*:*:*
First Time Iwt facesentry Access Control System
Iwt
Iwt facesentry Access Control System Firmware
References () http://www.iwt.com.hk - () http://www.iwt.com.hk - Product
References () https://www.exploit-db.com/exploits/47065 - () https://www.exploit-db.com/exploits/47065 - Exploit, Third Party Advisory, VDB Entry
References () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5524.php - () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5524.php - Exploit, Third Party Advisory

24 Dec 2025, 21:16

Type Values Removed Values Added
References () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5524.php - () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5524.php -

24 Dec 2025, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-12-24 20:15

Updated : 2025-12-30 20:14

NVD link : CVE-2019-25242

Mitre link : CVE-2019-25242

CVE.ORG link : CVE-2019-25242

JSON object : View

Products Affected

iwt

  • facesentry_access_control_system
  • facesentry_access_control_system_firmware
CWE
CWE-352

Cross-Site Request Forgery (CSRF)