Filtered by vendor Iwt Subscriptions
Filtered by product Facesentry Access Control System Firmware Subscriptions
Total 4 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2019-25243 1 Iwt 2 Facesentry Access Control System, Facesentry Access Control System Firmware 2025-12-30 8.8 High
FaceSentry 6.4.8 contains an authenticated remote command injection vulnerability in pingTest.php and tcpPortTest.php scripts. Attackers can exploit unsanitized input parameters to inject and execute arbitrary shell commands with root privileges by manipulating the 'strInIP' and 'strInPort' parameters.
CVE-2019-25242 1 Iwt 2 Facesentry Access Control System, Facesentry Access Control System Firmware 2025-12-30 4.3 Medium
FaceSentry Access Control System 6.4.8 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to change administrator passwords, add new admin users, or open access control doors by tricking authenticated users into loading a specially crafted webpage.
CVE-2019-25241 1 Iwt 2 Facesentry Access Control System, Facesentry Access Control System Firmware 2025-12-30 7.5 High
FaceSentry Access Control System 6.4.8 contains a critical authentication vulnerability with hard-coded SSH credentials for the wwwuser account. Attackers can leverage the insecure sudoers configuration to escalate privileges and gain root access by executing sudo commands without authentication.
CVE-2020-21999 1 Iwt 2 Facesentry Access Control System, Facesentry Access Control System Firmware 2024-11-21 8.8 High
iWT Ltd FaceSentry Access Control System 6.4.8 suffers from an authenticated OS command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user via the 'strInIP' POST parameter in pingTest PHP script.