CVE-2019-25241
CriticalSummary
FaceSentry Access Control System 6.4.8 contains a critical authentication vulnerability with hard-coded SSH credentials for the wwwuser account. Attackers can leverage the insecure sudoers configuration to escalate privileges and gain root access by executing sudo commands without authentication.
Risk Assessment
The risk includes full system compromise by an unauthorized attacker, potentially leading to data integrity and confidentiality breaches and disruption of the access control system.
Recommendation
Immediately change default SSH credentials and fix the sudoers configuration to prevent passwordless sudo commands. Consider updating the software to the latest version.
Original NVD description (English source)
FaceSentry Access Control System 6.4.8 contains a critical authentication vulnerability with hard-coded SSH credentials for the wwwuser account. Attackers can leverage the insecure sudoers configuration to escalate privileges and gain root access by executing sudo commands without authentication.