CVE-2019-25241

9.8 criticalEPSS 0.7%

Critical (9.8) in iwt facesentry access control system firmware. EPSS 0.7% chance of exploitation in the next 30 days.

FaceSentry Access Control System 6.4.8 contains a critical authentication vulnerability with hard-coded SSH credentials for the wwwuser account. Attackers can leverage the insecure sudoers configuration to escalate privileges and gain root access by executing sudo commands without authentication.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
CWE: CWE-798
Published: 2025-12-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

iwt:facesentry_access_control_system_firmware

References

http://www.iwt.com.hk
https://www.exploit-db.com/exploits/47067
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5526.php
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5526.php

Check your stack JSON