CVE-2019-25241 - CVE House

Back to Database

Status published Critical CVE-2019-25241

FaceSentry Access Control System 6.4.8 Remote SSH Root Access

9.8 CVSS

Vulnerability Description

FaceSentry Access Control System 6.4.8 contains a critical authentication vulnerability with hard-coded SSH credentials for the wwwuser account. Attackers can leverage the insecure sudoers configuration to escalate privileges and gain root access by executing sudo commands without authentication.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-25241

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

LiquidWorm as Gjoko Krstic of Zero Science Lab

References

More from iWT Ltd.

View All →

FaceSentry Access Control System 6.4.8 Cleartext Password Storage Vulnerability

FaceSentry Access Control System 6.4.8 Authentication Credentials MiTM Disclosure

FaceSentry Access Control System 6.4.8 Reflected Cross-Site Scripting via pluginInstall.php

FaceSentry 6.4.8 Authenticated Remote Command Injection via Ping Test

FaceSentry Access Control System 6.4.8 Cross-Site Request Forgery via Web Interface

Affected Vendor

iWT Ltd.

View all reports →

Affected Software

FaceSentry Access Control System

Vulnerable Versions:

6.4.8 build 264, 5.7.2 build 568, 5.7.0 build 539

Timeline

Official Publish: December 24th, 2025

Last Modified: July 15th, 2026

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1552 Unsecured Credentials

Credential Access

T1078 Valid Accounts

T1021 Remote Services

Lateral Movement

T1190 Exploit Public-Facing Application

T1098 Account Manipulation

Privilege Escalation