What’s Vulnerable › Vulnerabilities

CVE-2019-25243: FaceSentry 6.4.8 Authenticated Remote Command Injection via Ping Test

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-24 · updated 2026-06-17
• Weakness: CWE-78

Description

FaceSentry 6.4.8 contains an authenticated remote command injection vulnerability in pingTest.php and tcpPortTest.php scripts. Attackers can exploit unsanitized input parameters to inject and execute arbitrary shell commands with root privileges by manipulating the 'strInIP' and 'strInPort' parameters.

Affected products

• iWT Ltd. FaceSentry Access Control System: 5.7.0, 5.7.2, 6.4.8

References

• http://www.iwt.com.hk
• https://www.exploit-db.com/exploits/47064
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5523.php
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5523.php

Get alerted when CVE-2019-25243 or the next vulnerability affects your stack