What’s Vulnerable › Vulnerabilities

CVE-2019-25279: FaceSentry Access Control System 6.4.8 Cleartext Password Storage Vulnerability

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-08 · updated 2026-06-17
• Weakness: CWE-312

Description

FaceSentry Access Control System 6.4.8 contains a cleartext password storage vulnerability that allows attackers to access unencrypted credentials in the device's SQLite database. Attackers can directly read sensitive login information stored in /faceGuard/database/FaceSentryWeb.sqlite without additional authentication.

Affected products

• iWT Ltd. FaceSentry Access Control System: 5.7.0, 5.7.2, 6.4.8

References

• https://exchange.xforce.ibmcloud.com/vulnerabilities/163190
• https://packetstormsecurity.com/files/153501
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5529.php

Get alerted when CVE-2019-25279 or the next vulnerability affects your stack