CVE-2019-25279

HIGH

FaceSentry Access Control System 6.4.8 - Info Disclosure

Title source: llm

Description

FaceSentry Access Control System 6.4.8 contains a cleartext password storage vulnerability that allows attackers to access unencrypted credentials in the device's SQLite database. Attackers can directly read sensitive login information stored in /faceGuard/database/FaceSentryWeb.sqlite without additional authentication.

References (3)

[Third Party Advisory] https://exchange.xforce.ibmcloud.com/vulnerabilities/163190

[Exploit, Third Party Advisory] https://packetstormsecurity.com/files/153501

[Exploit, Third Party Advisory] https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5529.php

Scores

CVSS v3 7.5

EPSS 0.0005

EPSS Percentile 14.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Classification

CWE

CWE-312

Status published

Affected Products (3)

iwt/facesentry_access_control_system_firmware

iwt/facesentry_access_control_system_firmware

iwt/facesentry_access_control_system_firmware

Timeline

Published Jan 08, 2026

Tracked Since Feb 18, 2026