Vulnerabilities

TI-2019-15331 CVE-2019-25277 · GHSA-pw9x-q8pw-5v65

FaceSentry Access Control System 6.4.8 Reflected Cross-Site Scripting via pluginInstall.php

MEDIUM 56

FaceSentry Access Control System 6.4.8 contains a cross-site scripting vulnerability in the 'msg' parameter of pluginInstall.php that allows attackers to inject malicious scripts.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.0032 Published 2026-01-07 No fix listed CWE-79

TI-2019-15333 CVE-2019-25279 · GHSA-5557-v6f7-673v

FaceSentry Access Control System 6.4.8 Cleartext Password Storage Vulnerability

HIGH 69

FaceSentry Access Control System 6.4.8 contains a cleartext password storage vulnerability that allows attackers to access unencrypted credentials in the device's SQLite database.

CVSS 4.0MEDIUM 6.8 Local Low privileges No interaction EPSS 0.00223 Published 2026-01-07 No fix listed CWE-312

TI-2019-15332 CVE-2019-25278 · GHSA-6xfj-m9cp-qj5j

FaceSentry Access Control System 6.4.8 Authentication Credentials MiTM Disclosure

HIGH 72

FaceSentry Access Control System 6.4.8 contains a cleartext transmission vulnerability that allows remote attackers to intercept authentication credentials.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.0033 Published 2026-01-07 No fix listed CWE-319

TI-2019-15297 CVE-2019-25243 · GHSA-8cmh-3qph-fccm

FaceSentry 6.4.8 Authenticated Remote Command Injection via Ping Test

HIGH 73

FaceSentry 6.4.8 contains an authenticated remote command injection vulnerability in pingTest.php and tcpPortTest.php scripts.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.02608 Published 2025-12-24 No fix listed CWE-78

TI-2019-15296 CVE-2019-25242 · GHSA-p43h-75mm-qgfv

FaceSentry Access Control System 6.4.8 Cross-Site Request Forgery via Web Interface

MEDIUM 56

FaceSentry Access Control System 6.4.8 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00238 Published 2025-12-24 No fix listed CWE-352

TI-2019-15295 CVE-2019-25241 · GHSA-p8qm-v86v-r6gq

FaceSentry Access Control System 6.4.8 Remote SSH Root Access

HIGH 82

FaceSentry Access Control System 6.4.8 contains a critical authentication vulnerability with hard-coded SSH credentials for the wwwuser account.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00735 Published 2025-12-24 No fix listed CWE-798

TI-2020-14224 CVE-2020-21999 · GHSA-gvmq-4gxq-mx44

iWT Ltd FaceSentry Access Control System 6.4.8 suffers from an authenticated OS command…

MEDIUM 46

iWT Ltd FaceSentry Access Control System 6.4.8 suffers from an authenticated OS command injection vulnerability using default credentials.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.05242 Published 2021-05-04 No fix listed CWE-78