CVE-2019-25243 - CVE House

Back to Database

Status published High CVE-2019-25243

FaceSentry 6.4.8 Authenticated Remote Command Injection via Ping Test

8.7 CVSS

Vulnerability Description

FaceSentry 6.4.8 contains an authenticated remote command injection vulnerability in pingTest.php and tcpPortTest.php scripts. Attackers can exploit unsanitized input parameters to inject and execute arbitrary shell commands with root privileges by manipulating the 'strInIP' and 'strInPort' parameters.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-25243

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

LiquidWorm as Gjoko Krstic of Zero Science Lab

References

More from iWT Ltd.

View All →

FaceSentry Access Control System 6.4.8 Cleartext Password Storage Vulnerability

FaceSentry Access Control System 6.4.8 Authentication Credentials MiTM Disclosure

FaceSentry Access Control System 6.4.8 Reflected Cross-Site Scripting via pluginInstall.php

FaceSentry Access Control System 6.4.8 Cross-Site Request Forgery via Web Interface

FaceSentry Access Control System 6.4.8 Remote SSH Root Access

Affected Vendor

iWT Ltd.

View all reports →

Affected Software

FaceSentry Access Control System

Vulnerable Versions:

6.4.8 build 264, 5.7.2 build 568, 5.7.0 build 539

Timeline

Official Publish: December 24th, 2025

Last Modified: July 15th, 2026

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1005 Data from Local System

T1041 Exfiltration Over C2 Channel