CVE-2019-25279: falha de média gravidade em iWT Ltd. FaceSentry Access Control System
FaceSentry Access Control System 6.4.8 Cleartext Password Storage Vulnerability
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.8epss 0.2%
FaceSentry Access Control System 6.4.8 contains a cleartext password storage vulnerability that allows attackers to access unencrypted credentials in the device's SQLite database. Attackers can directly read sensitive login information stored in /faceGuard/database/FaceSentryWeb.sqlite without additional authentication.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
iWT Ltd. · FaceSentry Access Control SystemCVEs relacionadas — iWT Ltd. FaceSentry Access Control System
No mesmo produto, das mais perigosas para as menos.
CVE-2019-25243HIGHFaceSentry 6.4.8 Authenticated Remote Command Injection via Ping TestEPSS 2.6%CVE-2019-25241CRITICALFaceSentry Access Control System 6.4.8 Remote SSH Root AccessEPSS 0.7%CVE-2019-25278CRITICALFaceSentry Access Control System 6.4.8 Authentication Credentials MiTM DisclosureEPSS 0.3%CVE-2019-25277MEDIUMFaceSentry Access Control System 6.4.8 Reflected Cross-Site Scripting via pluginInstall.phpEPSS 0.3%CVE-2019-25242MEDIUMFaceSentry Access Control System 6.4.8 Cross-Site Request Forgery via Web InterfaceEPSS 0.2%