RCE in Iwt Facesentry Access Control System
CVE-2019-25243
FaceSentry 6.4.8 contains an authenticated remote command injection vulnerability in pingTest.php and tcpPortTest.php scripts. Attackers can exploit unsanitized input parameters to inject and execute arbitrary shell commands with root privileges by manipulating the 'strInIP' and 'strInPort' parameters.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.024 (82.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Iwt Facesentry_access_control_system
- Iwt Facesentry_access_control_system_firmware — versions 5.7.0, 5.7.2, 6.4.8
- Iwt Ltd. Facesentry Access Control System — versions 6.4.8 build 264, 5.7.2 build 568, 5.7.0 build 539
Weakness classification (CWE)
References
- ExploitDB-47064 (Exploit, exploit, Third Party Advisory, VDB Entry)
- Official Product Homepage (Product, product)
- Zero Science Lab Disclosure (ZSL-2019-5523) (Exploit, Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2019-25243?
- CVE-2019-25243 is a high-severity vulnerability in Iwt Facesentry Access Control System, classified under OS Command Injection. CVSS score: 8.8/10. Published 2025-12-24.
- How severe is CVE-2019-25243?
- High severity. CVSS v3 base score is 8.8 out of 10.