CVE-2019-25241
Published: 24 December 2025
Description
FaceSentry Access Control System 6.4.8 contains a critical authentication vulnerability with hard-coded SSH credentials for the wwwuser account. Attackers can leverage the insecure sudoers configuration to escalate privileges and gain root access by executing sudo commands without authentication.
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates changing default authenticators and protecting them from unauthorized disclosure, preventing exploitation of hard-coded SSH credentials for the wwwuser account.
Enforces least privilege to restrict the wwwuser account from executing sudo commands without authentication, blocking privilege escalation to root.
Requires secure configuration settings for system components like sudoers files, mitigating the insecure configuration that allows unauthenticated privilege escalation.
Security SummaryAI
CVE-2019-25241 is a critical authentication vulnerability in FaceSentry Access Control System version 6.4.8, stemming from hard-coded SSH credentials for the wwwuser account. This issue is exacerbated by an insecure sudoers configuration that permits privilege escalation to root access through sudo commands executed without authentication. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-798 (Use of Hard-coded Credentials). It was published on 2025-12-24.
The attack scenario enables remote attackers requiring no privileges, user interaction, or special access to exploit the flaw over the network with low complexity. An attacker can authenticate via SSH using the hard-coded wwwuser credentials, then execute sudo commands unrestricted by authentication to escalate to root privileges, resulting in high-impact compromise of confidentiality, integrity, and availability on the affected system.
Advisories and resources detailing the vulnerability include the vendor site at http://www.iwt.com.hk, an exploit at https://www.exploit-db.com/exploits/47067, and Zero Science's analysis at https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5526.php. These references provide further technical details on the issue, though specific patch or mitigation instructions are not detailed in the CVE description.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Hard-coded SSH credentials enable use of default/valid accounts (T1078.001) via external remote services like SSH (T1133, T1021.004); insecure sudoers allows privilege escalation (T1548.003).