CVE-2019-25279: Iwt Facesentry Access Control System Firmware

High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days.

FaceSentry Access Control System 6.4.8 contains a cleartext password storage vulnerability that allows attackers to access unencrypted credentials in the device's SQLite database. Attackers can directly read sensitive login information stored in /faceGuard/database/FaceSentryWeb.sqlite without additional authentication.

Affected products

• Iwt Facesentry Access Control System Firmware: version 5.7.0 only; version 5.7.2 only; version 6.4.8 only

Published 2026-01-08. Last modified 2026-06-17.