Security readout for executives and security teams
Plain-English summary
FaceSentry Access Control System versions listed in the sources include hard-coded SSH access that can lead to root-level control. For a physical access control platform, compromise could affect confidentiality, system integrity, and availability. The source bundle does not identify a vendor patch.
Executive priority
Treat as urgent if any affected FaceSentry system is reachable beyond a tightly controlled management network. Prioritize exposure reduction and vendor confirmation because compromise could give attackers root control over access control infrastructure.
Technical view
The CVE describes CWE-798 hard-coded credentials for an SSH-accessible wwwuser account, combined with an insecure sudoers configuration allowing unauthenticated privilege escalation to root. The CVSS 3.1 score is 9.8, network-accessible, low complexity, no privileges, and no user interaction.
Likely exposure
Exposure is most likely where affected FaceSentry Access Control System builds have SSH reachable from untrusted networks or broad internal networks. The bundle lists 6.4.8 build 264, 5.7.2 build 568, and 5.7.0 build 539.
Exploitation context
The bundle cites ExploitDB and Zero Science Lab public disclosure, so technical details are public. KEV is false in the provided data, and no cited source here confirms active exploitation in the wild.
Researcher notes
Evidence is source-limited: public advisory and ExploitDB references support the vulnerability class and affected builds, but the bundle does not provide patch status, CPEs, or confirmed exploitation. Avoid assuming other iWT products are affected.
Mitigation direction
- Identify all FaceSentry systems and confirm exact versions and builds.
- Check iWT Ltd. or integrator guidance for supported fixes or replacement paths.
- Restrict SSH and administration access to trusted management networks only.
- Remove internet exposure for affected devices wherever possible.
- Monitor authentication and privilege-use logs for suspicious access.
Validation and detection
- Inventory FaceSentry deployments, firmware, builds, and network locations.
- Confirm whether SSH is enabled and who can reach it.
- Review sudoers and account configuration through authorized administrative access.
- Check logs for unexpected SSH logins or privileged actions.
- Validate compensating network controls around each affected device.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-798: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2019-25241 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9VulnCheckCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6VulnCheckVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-47067CVE reference, VulnCheck · exploit
- Zero Science Lab Disclosure (ZSL-2019-5526)CVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use of Hard-coded Credentials
Use of Hard-coded Credentials represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.