CVE-2019-25242: medium-severity vulnerability in iWT Ltd. FaceSentry Access Control System
FaceSentry Access Control System 6.4.8 Cross-Site Request Forgery via Web Interface
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.1epss 0.2%
FaceSentry Access Control System 6.4.8 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to change administrator passwords, add new admin users, or open access control doors by tricking authenticated users into loading a specially crafted webpage.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
iWT Ltd. · FaceSentry Access Control SystemRelated CVEs — iWT Ltd. FaceSentry Access Control System
In the same product, most dangerous first.
CVE-2019-25243HIGHFaceSentry 6.4.8 Authenticated Remote Command Injection via Ping TestEPSS 2.6%CVE-2019-25241CRITICALFaceSentry Access Control System 6.4.8 Remote SSH Root AccessEPSS 0.7%CVE-2019-25278CRITICALFaceSentry Access Control System 6.4.8 Authentication Credentials MiTM DisclosureEPSS 0.3%CVE-2019-25277MEDIUMFaceSentry Access Control System 6.4.8 Reflected Cross-Site Scripting via pluginInstall.phpEPSS 0.3%CVE-2019-25279MEDIUMFaceSentry Access Control System 6.4.8 Cleartext Password Storage VulnerabilityEPSS 0.2%