{"id":"CVE-2019-25241","state":"PUBLISHED","title":"FaceSentry Access Control System 6.4.8 Remote SSH Root Access","description":"FaceSentry Access Control System 6.4.8 contains a critical authentication vulnerability with hard-coded SSH credentials for the wwwuser account. Attackers can leverage the insecure sudoers configuration to escalate privileges and gain root access by executing sudo commands without authentication.","publishedAt":"2025-12-24T19:27:58.126Z","updatedAt":"2026-07-15T01:23:42.165Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"VulnCheck"},"assigner":"VulnCheck","products":["iWT Ltd. FaceSentry Access Control System"],"affected":[{"vendor":"iWT Ltd.","product":"FaceSentry Access Control System","defaultStatus":"unaffected","versions":[{"version":"6.4.8 build 264","status":"affected"},{"version":"5.7.2 build 568","status":"affected"},{"version":"5.7.0 build 539","status":"affected"}]}],"references":["https://www.exploit-db.com/exploits/47067","http://www.iwt.com.hk","https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5526.php"],"weaknesses":["CWE-798"],"ingestedAt":"2026-10-29T19:45:53.332Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2019/25xxx/CVE-2019-25241.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2019-25241","state":"PUBLISHED","datePublished":"2025-12-24T19:27:58.126Z","dateUpdated":"2026-07-15T01:23:42.165Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2025-12-24T14:27:12.476Z"},"containers":{"cna":{"title":"FaceSentry Access Control System 6.4.8 Remote SSH Root Access","descriptions":[{"lang":"en","value":"FaceSentry Access Control System 6.4.8 contains a critical authentication vulnerability with hard-coded SSH credentials for the wwwuser account. Attackers can leverage the insecure sudoers configuration to escalate privileges and gain root access by executing sudo commands without authentication."}],"affected":[{"vendor":"iWT Ltd.","product":"FaceSentry Access Control System","defaultStatus":"unaffected","versions":[{"version":"6.4.8 build 264","status":"affected"},{"version":"5.7.2 build 568","status":"affected"},{"version":"5.7.0 build 539","status":"affected"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/47067","name":"ExploitDB-47067","tags":["exploit"]},{"url":"http://www.iwt.com.hk","name":"Vendor Product Homepage","tags":["product"]},{"url":"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5526.php","name":"Zero Science Lab Disclosure (ZSL-2019-5526)","tags":["third-party-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-798","description":"Use of Hard-coded Credentials","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-07-15T01:23:42.165Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:h:iwt:facesentry_access_control_system:6.4.8_build_264:*:*:*:*:*:*:*"},{"vulnerable":true,"criteria":"cpe:2.3:h:iwt:facesentry_access_control_system:5.7.2_build_568:*:*:*:*:*:*:*"},{"vulnerable":true,"criteria":"cpe:2.3:h:iwt:facesentry_access_control_system:5.7.0_build_539:*:*:*:*:*:*:*"}]}]}],"credits":[{"lang":"en","type":"finder","value":"LiquidWorm as Gjoko Krstic of Zero Science Lab"}],"datePublic":"2019-05-28T00:00:00.000Z","source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5526.php","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-24T20:04:18.019329Z","id":"CVE-2019-25241","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-24T20:23:18.700Z"}}]}}}