What’s Vulnerable › Vulnerabilities

CVE-2019-25241: FaceSentry Access Control System 6.4.8 Remote SSH Root Access

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-24 · updated 2026-06-17
• Weakness: CWE-798

Description

FaceSentry Access Control System 6.4.8 contains a critical authentication vulnerability with hard-coded SSH credentials for the wwwuser account. Attackers can leverage the insecure sudoers configuration to escalate privileges and gain root access by executing sudo commands without authentication.

Affected products

• iWT Ltd. FaceSentry Access Control System: 5.7.0, 5.7.2, 6.4.8

References

• http://www.iwt.com.hk
• https://www.exploit-db.com/exploits/47067
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5526.php
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5526.php

Get alerted when CVE-2019-25241 or the next vulnerability affects your stack