CVE-2019-25279

🗓️ 07 Jan 2026 23:10:00Reported by VulnCheckType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 29 Views🌐 WEB

FaceSentry 6.4.8 stores credentials in cleartext in the database, exposing login data.

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2019-25279	8 Jan 202601:24	–	circl
CNNVD	iWT FaceSentry Access Control System 安全漏洞	8 Jan 202600:00	–	cnnvd
Cvelist	CVE-2019-25279 FaceSentry Access Control System 6.4.8 Cleartext Password Storage Vulnerability	7 Jan 202623:10	–	cvelist
NVD	CVE-2019-25279	8 Jan 202600:15	–	nvd
OSV	CVE-2019-25279	8 Jan 202600:15	–	osv
Positive Technologies	PT-2026-1677	7 Jan 202600:00	–	ptsecurity
Vulnrichment	CVE-2019-25279 FaceSentry Access Control System 6.4.8 Cleartext Password Storage Vulnerability	7 Jan 202623:10	–	vulnrichment
Zero Science Lab	FaceSentry Access Control System 6.4.8 Cleartext Password Storage	30 Jun 201900:00	–	zeroscience

NVD

Vulners

CNA

Node

AND

iwt facesentry_access_control_system_firmwareMatch5.7.0

iwt facesentry_access_control_system_firmwareMatch5.7.2

iwt facesentry_access_control_system_firmwareMatch6.4.8

iwt facesentry_access_control_systemMatch-

[
  {
    "vendor": "iWT Ltd.",
    "product": "FaceSentry Access Control System",
    "versions": [
      {
        "version": "6.4.8 build 264",
        "status": "affected"
      },
      {
        "version": "5.7.2 build 568",
        "status": "affected"
      },
      {
        "version": "5.7.0 build 539",
        "status": "affected"
      }
    ]
  }
]

Source	Link
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/163190
packetstormsecurity	www.packetstormsecurity.com/files/153501
zeroscience	www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5529.php

Parameter	Position	Path	Description	CWE
fUserPassword	path	database/insert_db.txt	Cleartext credentials stored in SQLite DB exposed via a web path; enables extraction of plaintext passwords from the device database.	CWE-312
fUserID	path	database/insert_db.txt	Cleartext credentials stored in SQLite DB exposed via a web path; enables extraction of plaintext passwords from the device database.	CWE-312
fUserFunctionPermissionGroupID	path	database/insert_db.txt	Cleartext credentials stored in SQLite DB exposed via a web path; enables extraction of plaintext passwords from the device database.	CWE-312
fUserLanguage	path	database/insert_db.txt	Cleartext credentials stored in SQLite DB exposed via a web path; enables extraction of plaintext passwords from the device database.	CWE-312
fStatus	path	database/insert_db.txt	Cleartext credentials stored in SQLite DB exposed via a web path; enables extraction of plaintext passwords from the device database.	CWE-312

15 Jul 2026 01:23Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.17.5

CVSS 46.8

EPSS0.00199

SSVC

CWE-312