CVE-2019-25241

Critical · 9.8

CVSS

9.8

EPSS

0.7%

Published

Dec 24, 2025

CISA due date

—

The record

FaceSentry Access Control System 6.4.8 contains a critical authentication vulnerability with hard-coded SSH credentials for the wwwuser account. Attackers can leverage the insecure sudoers configuration to escalate privileges and gain root access by executing sudo commands without authentication.

Affected packages

Ecosystem	Package	Introduced	Fixed