Description
FaceSentry Access Control System 6.4.8 contains a cleartext password storage vulnerability that allows attackers to access unencrypted credentials in the device's SQLite database. Attackers can directly read sensitive login information stored in /faceGuard/database/FaceSentryWeb.sqlite without additional authentication.
References
https://exchange.xforce.ibmcloud.com/vulnerabilities/163190
Third Party Advisory
https://packetstormsecurity.com/files/153501
ExploitThird Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5529.php
ExploitThird Party Advisory
CVSS impact metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
8.2 · High
Information
Source identifier
Vulnerability status
Analyzed
Published
2026-01-08T00:15:58.107Z
1 week agoLast modified
2026-01-15T19:36:56.593Z
4 hours ago