CVE-2019-25241: Iwt Facesentry Access Control System Firmware

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

FaceSentry Access Control System 6.4.8 contains a critical authentication vulnerability with hard-coded SSH credentials for the wwwuser account. Attackers can leverage the insecure sudoers configuration to escalate privileges and gain root access by executing sudo commands without authentication.

Affected products

• Iwt Facesentry Access Control System Firmware: version 5.7.0 only; version 5.7.2 only; version 6.4.8 only

Published 2025-12-24. Last modified 2026-06-17.