Description
FaceSentry Access Control System 6.4.8 contains a critical authentication vulnerability with hard-coded SSH credentials for the wwwuser account. Attackers can leverage the insecure sudoers configuration to escalate privileges and gain root access by executing sudo commands without authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| iWT | FaceSentry Access Control System | 6.4.8 build 264, 5.7.2 build 568, 5.7.0 build 539 | — |
References
- ExploitDB-47067 exploit
- Vendor Product Homepage product
- Zero Science Lab Disclosure (ZSL-2019-5526) third-party-advisory