Description (CNA)
FaceSentry Access Control System 6.4.8 contains a critical authentication vulnerability with hard-coded SSH credentials for the wwwuser account. Attackers can leverage the insecure sudoers configuration to escalate privileges and gain root access by executing sudo commands without authentication.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| iWT Ltd. / FaceSentry Access Control System | affected 6.4.8 build 264; affected 5.7.2 build 568; affected 5.7.0 build 539 |
CWE
CWE-798
References
- https://www.exploit-db.com/exploits/47067
- http://www.iwt.com.hk
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5526.php
ADP enrichment
No English description supplied.