CVE-2019-25242: FaceSentry Access Control System 6.4.8 Cross-Site Request Forgery via Web Interface

Security readout for executives and security teams

FaceSentry access control systems have a web-interface CSRF flaw. If an administrator is logged in and visits a malicious page, the attacker may trigger administrative changes, including password changes, new admin creation, or door actions. This is important because the affected product controls physical access, but exploitation requires user interaction. Exposure is most relevant where the FaceSentry administrative web interface is reachable by administrators from normal browsing environments. Internet exposure would increase risk, but the provided sources do not confirm common exposure patterns or default deployment architecture. Treat as a targeted physical-security risk, not a mass emergency based on current evidence. Prioritize if FaceSentry administers sensitive facilities, is reachable beyond a restricted management network, or is used by administrators who browse email or the web from the same session. Mitigation focus: Check iWT vendor guidance for fixed versions or official mitigations.; Restrict access to the FaceSentry administrative web interface to trusted networks.; Use separate, hardened administrator workstations for access-control administration..

Prepared

Apr 30, 2026, 03:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.