IWT FaceSentry Access Control System
Approved changes feed: RSS · Atom
cpe:2.3:h:iwt:facesentry_access_control_system:-:*:*:*:*:*:*:*
part: h version: - update: *
| Vendor | Iwt (0f33770e-f677-5702-9e3d-11e81418ad9e) |
|---|---|
| Product | Facesentry Access Control System (c2946001-8d1c-5eb2-85cf-d7a8ff0c53cf) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2020-21999 |
not_vulnerable | 2026-06-08 05:22:31.188050 |
Details available
iWT Ltd FaceSentry Access Control System 6.4.8 suffers from an authenticated OS command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user via the 'strInIP' POST parameter in pingTest PHP script.
Published: 2021-05-04T15:21:53.000Z
Updated: 2024-08-04T14:30:33.879Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-25279 |
not_vulnerable | 2026-06-08 05:13:42.171386 |
FaceSentry Access Control System 6.4.8 Cleartext Password Storage Vulnerability
HIGH (7.5)
FaceSentry Access Control System 6.4.8 contains a cleartext password storage vulnerability that allows attackers to access unencrypted credentials in the device's SQLite database. Attackers can directly read sensitive login information stored in /faceGuard/database/FaceSentryWeb.sqlite without additional authentication.
Published: 2026-01-07T23:10:00.907Z
Updated: 2026-07-15T01:23:45.741Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-25278 |
not_vulnerable | 2026-06-08 05:13:42.170888 |
FaceSentry Access Control System 6.4.8 Authentication Credentials MiTM Disclosure
MEDIUM (5.9)
FaceSentry Access Control System 6.4.8 contains a cleartext transmission vulnerability that allows remote attackers to intercept authentication credentials. Attackers can perform man-in-the-middle attacks to capture HTTP cookie authentication information during network communication.
Published: 2026-01-07T23:09:59.751Z
Updated: 2026-07-15T01:23:44.997Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-25277 |
not_vulnerable | 2026-06-08 05:13:42.170366 |
FaceSentry Access Control System 6.4.8 Reflected Cross-Site Scripting via pluginInstall.php
MEDIUM (6.1)
FaceSentry Access Control System 6.4.8 contains a cross-site scripting vulnerability in the 'msg' parameter of pluginInstall.php that allows attackers to inject malicious scripts. Attackers can exploit the unvalidated input to execute arbitrary JavaScript in victim browsers, potentially stealing authentication credentials and conducting phishing attacks.
Published: 2026-01-07T23:11:06.730Z
Updated: 2026-05-24T01:36:20.841Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-25243 |
not_vulnerable | 2026-06-08 05:13:42.110079 |
FaceSentry 6.4.8 Authenticated Remote Command Injection via Ping Test
HIGH (8.8)
FaceSentry 6.4.8 contains an authenticated remote command injection vulnerability in pingTest.php and tcpPortTest.php scripts. Attackers can exploit unsanitized input parameters to inject and execute arbitrary shell commands with root privileges by manipulating the 'strInIP' and 'strInPort' parameters.
Published: 2025-12-24T19:27:58.965Z
Updated: 2026-07-15T01:23:42.867Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-25242 |
not_vulnerable | 2026-06-08 05:13:42.109652 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-25241 |
not_vulnerable | 2026-06-08 05:13:42.107204 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.