CVE-2019-25278: falha crítica em iWT Ltd. FaceSentry Access Control System
FaceSentry Access Control System 6.4.8 Authentication Credentials MiTM Disclosure
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.1epss 0.3%
FaceSentry Access Control System 6.4.8 contains a cleartext transmission vulnerability that allows remote attackers to intercept authentication credentials. Attackers can perform man-in-the-middle attacks to capture HTTP cookie authentication information during network communication.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
iWT Ltd. · FaceSentry Access Control SystemCVEs relacionadas — iWT Ltd. FaceSentry Access Control System
No mesmo produto, das mais perigosas para as menos.
CVE-2019-25243HIGHFaceSentry 6.4.8 Authenticated Remote Command Injection via Ping TestEPSS 2.6%CVE-2019-25241CRITICALFaceSentry Access Control System 6.4.8 Remote SSH Root AccessEPSS 0.7%CVE-2019-25277MEDIUMFaceSentry Access Control System 6.4.8 Reflected Cross-Site Scripting via pluginInstall.phpEPSS 0.3%CVE-2019-25242MEDIUMFaceSentry Access Control System 6.4.8 Cross-Site Request Forgery via Web InterfaceEPSS 0.2%CVE-2019-25279MEDIUMFaceSentry Access Control System 6.4.8 Cleartext Password Storage VulnerabilityEPSS 0.2%