PT-2025-53329 · Unknown · Facesentry

Published 2025-12-24 · Updated 2025-12-24 · CVE-2019-25243

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FaceSentry version 6.4.8

Description FaceSentry 6.4.8 has a remote command injection issue in the pingTest.php and tcpPortTest.php scripts. An attacker with authentication can inject and execute arbitrary shell commands with root privileges. This is possible by manipulating the strInIP and strInPort parameters, which are not properly sanitized.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the pingTest.php and tcpPortTest.php scripts. Sanitize the strInIP and strInPort parameters before processing them in the pingTest.php and tcpPortTest.php scripts.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-25243

Affected Products

Facesentry

References · 6

• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2019-5523.php · Exploit
• 🔥 https://exploit-db.com/exploits/47064 · Exploit
• https://osv.dev/vulnerability/CVE-2019-25243 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25243 · Security Note
• http://iwt.com.hk · Note
• https://t.me/CVEtracker/40620 · Telegram Post