Security readout for executives and security teams
Plain-English summary
FaceSentry Access Control System can send authentication cookies in cleartext in listed versions. Someone positioned on the network could intercept login material and potentially access the access-control system. This matters because the product controls physical access, so credential theft could have operational and safety implications.
Executive priority
Treat as urgent for environments using affected FaceSentry versions, especially in facilities where the system governs sensitive physical access. Prioritize confirming exposure and obtaining vendor remediation. If encryption cannot be assured, reduce network access immediately while planning replacement or upgrade options.
Technical view
CVE-2019-25278 is a CWE-319 cleartext transmission issue affecting FaceSentry Access Control System 6.4.8 build 264, 5.7.2 build 568, and 5.7.0 build 539. The record describes HTTP cookie authentication information exposed to man-in-the-middle interception. CVSS v4.0 is 9.1, with network attack vector and high confidentiality and integrity impact.
Likely exposure
Risk is highest where FaceSentry web or authentication traffic crosses shared, wireless, routed, or otherwise untrusted networks. Internet exposure is not stated in the sources. Internal-only deployments can still be exposed to insider, compromised-host, or adjacent-network interception risks.
Exploitation context
The sources describe remote man-in-the-middle credential interception, not direct remote code execution. CVSS lists high attack complexity but no privileges or user interaction. Packet Storm has an exploit entry, but the provided sources do not establish active exploitation in the wild or CISA KEV listing.
Researcher notes
The evidence identifies affected versions, CWE-319, and credential-cookie exposure via man-in-the-middle conditions. The bundle does not name a vendor patch, workaround, or KEV status. Packet Storm indicates public exploit material exists, but this assessment avoids operational exploit details and does not infer active exploitation.
Mitigation direction
- Check iWT Ltd. guidance for fixed versions or supported remediation.
- Remove FaceSentry management/authentication interfaces from untrusted networks.
- Require encrypted transport, such as HTTPS or a trusted VPN, where supported.
- Segment physical access control systems from user and guest networks.
- Rotate credentials if cleartext exposure may have occurred.
- Monitor for suspicious FaceSentry sessions or administrative activity.
Validation and detection
- Inventory FaceSentry versions and builds in all facilities.
- Identify whether affected builds 6.4.8, 5.7.2, or 5.7.0 are deployed.
- Confirm authentication traffic is not sent over unencrypted HTTP.
- Review network paths for shared, wireless, or untrusted segments.
- Check vendor advisories for patch or configuration guidance.
- Assess logs for unusual authentication activity after possible exposure.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-319: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2019-25278 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
9.1CriticalVector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- Zero Science Lab Vulnerability AdvisoryCVE reference · third-party-advisory
- Packet Storm Security Exploit EntryCVE reference · exploit
- IBM X-Force Vulnerability Exchange EntryCVE reference · vdb-entry
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cleartext Transmission of Sensitive Information
Cleartext Transmission of Sensitive Information represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.