Description
FaceSentry Access Control System 6.4.8 contains a cleartext password storage vulnerability that allows attackers to access unencrypted credentials in the device's SQLite database. Attackers can directly read sensitive login information stored in /faceGuard/database/FaceSentryWeb.sqlite without additional authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| iWT | FaceSentry Access Control System | 6.4.8 build 264, 5.7.2 build 568, 5.7.0 build 539 | — |
References
- Zero Science Lab Vulnerability Advisory third-party-advisory
- IBM X-Force Exchange Vulnerability Entry vdb-entry
- Packet Storm Security Exploit Entry exploit