IWT FaceSentry Access Control System

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

7CVEs

CVE-2019-25241

FaceSentry Access Control System 6.4.8 Remote SSH Root Access

Published 2025-12-24 · Modified

9.8EPSS 0.007

CVE-2019-25278

FaceSentry Access Control System 6.4.8 Authentication Credentials MiTM Disclosure

Published 2026-01-07 · Modified

9.1EPSS 0.003

CVE-2020-21999

iWT Ltd FaceSentry Access Control System 6.4.8 suffers from an authenticated OS command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user via the 'strInIP' POST parameter in pingTest PHP script.

Published 2021-05-04 · Modified

9.0EPSS 0.052

CVE-2019-25243

FaceSentry 6.4.8 Authenticated Remote Command Injection via Ping Test

Published 2025-12-24 · Analyzed

8.8EPSS 0.026

CVE-2019-25279

FaceSentry Access Control System 6.4.8 Cleartext Password Storage Vulnerability

Published 2026-01-07 · Modified

7.5EPSS 0.002

CVE-2019-25277

FaceSentry Access Control System 6.4.8 Reflected Cross-Site Scripting via pluginInstall.php