CVE-2019-25279

Published: Jan 8, 2026Modified: Jan 16, 2026

6.8

Vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

FaceSentry Access Control System 6.4.8 contains a cleartext password storage vulnerability that allows attackers to access unencrypted credentials in the device's SQLite database. Attackers can directly read sensitive login information stored in /faceGuard/database/FaceSentryWeb.sqlite without additional authentication.

Affected (3)

Products: Iwt: Facesentry Access Control System Firmware

Iwt

1 product

Facesentry Access Control System Firmware

Configuration A

3 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Iwt Facesentry Access Control System Firmware	Version 5.7.0
Iwt Facesentry Access Control System Firmware	Version 5.7.2
Iwt Facesentry Access Control System Firmware	Version 6.4.8

Running on/with	Platform Versions
Iwt Facesentry Access Control System	All versions

Related CWEs

CWE-312

Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

References (3)

https://exchange.xforce.ibmcloud.com/vulnerabilities/163190

Source: disclosure@vulncheck.com

Third Party Advisory

https://packetstormsecurity.com/files/153501

Source: disclosure@vulncheck.com

ExploitThird Party Advisory

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5529.php

Source: disclosure@vulncheck.com

ExploitThird Party Advisory

Timeline

No history available yet.