RCE in Iwt Facesentry Access Control System
CVE-2019-25243
FaceSentry 6.4.8 contains an authenticated remote command injection vulnerability in pingTest.php and tcpPortTest.php scripts. Attackers can exploit unsanitized input parameters to inject and execute arbitrary shell commands with root privileges by manipulating the 'strInIP' and 'strInPort' parameters.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.026 (84.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 85th percentile — 84.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.026 · newest: 0.026 · change: -0.000
Affected products
- Iwt Facesentry Access Control System
- Iwt Facesentry Access Control System Firmware — versions 5.7.0, 5.7.2, 6.4.8
- Iwt Ltd. Facesentry Access Control System — versions 6.4.8 build 264, 5.7.2 build 568, 5.7.0 build 539
Weakness classification (CWE)
References
- ExploitDB-47064 (Exploit, exploit, Third Party Advisory, VDB Entry)
- Official Product Homepage (Product, product)
- Zero Science Lab Disclosure (ZSL-2019-5523) (Exploit, Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2019-25243?
- CVE-2019-25243 is a high-severity vulnerability in Iwt Facesentry Access Control System, classified under OS Command Injection. CVSS score: 8.8/10. Published 2025-12-24.
- How severe is CVE-2019-25243?
- High severity. CVSS v3 base score is 8.8 out of 10.