PT-2025-53328 · Unknown · Facesentry Access Control System

Published 2025-12-24 · Updated 2025-12-24 · CVE-2019-25242

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions FaceSentry Access Control System version 6.4.8

Description The FaceSentry Access Control System is susceptible to a cross-site request forgery condition. This allows attackers to execute administrative actions without explicit user permission. An attacker can create malicious webpages designed to alter administrator passwords, create new administrator accounts, or unlock access control doors by deceiving authenticated users into visiting the crafted webpage.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-25242

Affected Products

Facesentry Access Control System

References · 6

• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2019-5524.php · Exploit
• 🔥 https://exploit-db.com/exploits/47065 · Exploit
• https://osv.dev/vulnerability/CVE-2019-25242 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25242 · Security Note
• http://iwt.com.hk · Note
• https://t.me/CVEtracker/40619 · Telegram Post