CVE-2019-25241

FaceSentry Access Control System 6.4.8 contains a critical authentication vulnerability with hard-coded SSH credentials for the wwwuser account. Attackers can leverage the insecure sudoers configuration to escalate privileges and gain root access by executing sudo commands without authentication.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.74% chance of exploitation in the next 30 days, 52th percentile

Published

2025-12-24

Updated

2026-07-15

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/47067

References

• CVE Record
• NVD entry

Related

• CVE-2019-25240
• CVE-2019-25242
• CVE-2019-25239
• CVE-2019-25243
• CVE-2019-25238
• CVE-2019-25244