CVE-2019-25242

Опубликовано: 24 дек. 2025

Источник: nvd

CVSS3: 4.3

EPSS Низкий

Описание

FaceSentry Access Control System 6.4.8 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to change administrator passwords, add new admin users, or open access control doors by tricking authenticated users into loading a specially crafted webpage.

Ссылки

http://www.iwt.com.hk
Product
https://www.exploit-db.com/exploits/47065
Exploit
Third Party Advisory
VDB Entry
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5524.php
Exploit
Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5524.php
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:iwt:facesentry_access_control_system_firmware:5.7.0:*:*:*:*:*:*:*

cpe:2.3:h:iwt:facesentry_access_control_system:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:iwt:facesentry_access_control_system_firmware:5.7.2:*:*:*:*:*:*:*

cpe:2.3:h:iwt:facesentry_access_control_system:-:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:o:iwt:facesentry_access_control_system_firmware:6.4.8:*:*:*:*:*:*:*

cpe:2.3:h:iwt:facesentry_access_control_system:-:*:*:*:*:*:*:*

EPSS

Процентиль: 5%

0.00021

Низкий

4.3 Medium

CVSS3

Дефекты

CWE-352

Связанные уязвимости

GHSA-p43h-75mm-qgfv

CVSS3: 4.3

github

около 1 месяца назад

EPSS

Процентиль: 5%

0.00021

Низкий

4.3 Medium

CVSS3

Дефекты

CWE-352