CVE-2019-25279 Overview
CVE-2019-25279 affects the IWT FaceSentry Access Control System version 6.4.8. The device stores user credentials in cleartext within a local SQLite database at /faceGuard/database/FaceSentryWeb.sqlite. An attacker with local access to the device file system can read login credentials directly without any decryption step. This weakness maps to CWE-312: Cleartext Storage of Sensitive Information.
The vulnerability impacts confidentiality of stored authentication material on the appliance. Recovered credentials may enable downstream attacks against the management web interface and any reused account on adjacent systems.
Critical Impact
Local attackers can extract administrative credentials in plaintext from the FaceSentry SQLite database, enabling full takeover of the physical access control system.
Affected Products
- IWT FaceSentry Access Control System Firmware 5.7.0
- IWT FaceSentry Access Control System Firmware 5.7.2
- IWT FaceSentry Access Control System Firmware 6.4.8
Discovery Timeline
- 2026-01-08 - CVE-2019-25279 published to NVD
- 2026-01-16 - Last updated in NVD database
Technical Details for CVE-2019-25279
Vulnerability Analysis
The FaceSentry Access Control System is a biometric facial recognition appliance used to control physical entry to buildings and restricted areas. The device runs an embedded web management application backed by a SQLite database that holds user account records, configuration, and access logs.
The firmware persists user passwords as plaintext strings inside the FaceSentryWeb.sqlite database file. No hashing, salting, or encryption is applied before write operations. Any process or user with read access to /faceGuard/database/FaceSentryWeb.sqlite can open the database with a standard SQLite client and dump credentials directly.
This design violates baseline credential storage practices defined in CWE-312. The vulnerability is local in scope but high in confidentiality impact because the recovered credentials grant administrative access to the physical security appliance.
Root Cause
The root cause is the firmware's failure to apply a one-way hash function such as bcrypt, scrypt, or Argon2 to user passwords before persisting them. The application also does not encrypt the database file at rest. Both controls would prevent trivial credential recovery from a stolen device image or local shell.
Attack Vector
An attacker requires local access to the device, which can be obtained through a low-privileged shell, a recovered firmware image, a removed storage chip, or chained exploitation from another flaw on the appliance. Once filesystem access is achieved, extraction reduces to opening the SQLite file and issuing a SELECT statement against the users table.
The vulnerability has no public proof of concept and is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Zero Science Vulnerability ZSL-2019-5529 advisory and the Packet Storm Security File #153501 for the original research notes.
Detection Methods for CVE-2019-25279
Indicators of Compromise
- Unexpected read access or copy operations targeting /faceGuard/database/FaceSentryWeb.sqlite on the appliance.
- Outbound transfers of .sqlite or .db files from the FaceSentry device to unknown hosts.
- Successful logins to the FaceSentry web interface from new source IP addresses or at unusual times.
- Presence of SQLite client binaries or shell tools that should not exist on a hardened embedded appliance.
Detection Strategies
- Monitor network traffic to and from FaceSentry management interfaces for anomalous file transfer protocols such as TFTP, FTP, or SCP.
- Audit administrative web sessions for logins outside expected business hours or from non-allowlisted networks.
- Inspect upstream switch logs for new MAC or IP pairings on ports connected to FaceSentry devices.
Monitoring Recommendations
- Forward FaceSentry authentication and management logs to a central SIEM for correlation with physical access events.
- Alert on any configuration change to access control policies, user lists, or door schedules.
- Track integrity of the appliance firmware version and flag unexpected downgrades to 5.7.0, 5.7.2, or 6.4.8.
How to Mitigate CVE-2019-25279
Immediate Actions Required
- Rotate all FaceSentry administrative and user credentials, and rotate any reused passwords on adjacent systems.
- Restrict management network access to the appliance using a dedicated VLAN and firewall allowlist of administrator workstations.
- Disable unused services on the device, including remote shell and file transfer daemons.
- Inventory all FaceSentry units and confirm physical tamper protections are intact.
Patch Information
No vendor advisory or fixed firmware version is referenced in the available data for CVE-2019-25279. Contact IWT directly for guidance on supported firmware that addresses cleartext credential storage. Review the IBM X-Force Vulnerability #163190 entry for ongoing status updates.
Workarounds
- Place FaceSentry appliances on an isolated management network unreachable from general user subnets.
- Enforce unique, high-entropy passwords on every FaceSentry account to limit credential reuse damage.
- Monitor physical access to the appliance enclosure and disable accessible debug ports such as UART or USB console.
- Where supported, enable full-disk or partition-level encryption on the device storage media.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
