VulnerabilityModified
CVE-2020-21999
iWT Ltd FaceSentry Access Control System 6.4.8 suffers from an authenticated OS command injection vulnerability using default credentials.
HIGH 8.8EPSS 5.24%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.24%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
iWT Ltd FaceSentry Access Control System 6.4.8 suffers from an authenticated OS command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user via the 'strInIP' POST parameter in pingTest PHP script.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 5.24% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- iwt/facesentry access control system firmware
- Source
- cve@mitre.org
References
- https://www.exploit-db.com/exploits/47066Exploit, Third Party Advisory, VDB Entry
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5525.phpExploit, Third Party Advisory
- https://www.exploit-db.com/exploits/47066Exploit, Third Party Advisory, VDB Entry
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5525.phpExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.