CVE-2019-25243

HIGH

8.8

Beschreibung

FaceSentry 6.4.8 contains an authenticated remote command injection vulnerability in pingTest.php and tcpPortTest.php scripts. Attackers can exploit unsanitized input parameters to inject and execute arbitrary shell commands with root privileges by manipulating the 'strInIP' and 'strInPort' parameters.

CVE Details

CVSS v3.1 Bewertung8.8

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht12/24/2025

Zuletzt geandert12/30/2025

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

iwt:facesentry_access_control_systemiwt:facesentry_access_control_system_firmware

Schwachen (CWE)

CWE-78

Referenzen

http://www.iwt.com.hk(disclosure@vulncheck.com)

https://www.exploit-db.com/exploits/47064(disclosure@vulncheck.com)

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5523.php(disclosure@vulncheck.com)

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5523.php(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.