CVE-2019-25242

MEDIUM

FaceSentry Access Control System 6.4.8 - CSRF

Title source: llm

Description

FaceSentry Access Control System 6.4.8 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to change administrator passwords, add new admin users, or open access control doors by tricking authenticated users into loading a specially crafted webpage.

Exploits (1)

exploitdb WORKING POC

by LiquidWorm · textwebappshardware

https://www.exploit-db.com/exploits/47065

View Code ZIP pw:eip

References (3)

[Product] http://www.iwt.com.hk

[Exploit, Third Party Advisory, VDB Entry] https://www.exploit-db.com/exploits/47065

[Exploit, Third Party Advisory] https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5524.php

Scores

CVSS v3 4.3

EPSS 0.0003

EPSS Percentile 7.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Classification

CWE

CWE-352

Status published

Affected Products (3)

iwt/facesentry_access_control_system_firmware

iwt/facesentry_access_control_system_firmware

iwt/facesentry_access_control_system_firmware

Timeline

Published Dec 24, 2025

Tracked Since Feb 18, 2026