CVE-2020-21999 - iWT Ltd FaceSentry Access Control System 6.4.8 suffers from an authenticated OS command injection vulnerability using default credentials

Back Back to CVE browser

HIGH

iWT Ltd FaceSentry Access Control System 6.4.8 suffers from an authenticated OS command injection vulnerability using default credentials

Published May 4, 2021

8.8

HIGH

CVSS 3.1

EPSS 5.24%

Description

iWT Ltd FaceSentry Access Control System 6.4.8 suffers from an authenticated OS command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user via the 'strInIP' POST parameter in pingTest PHP script.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-14765
Advisory
https://www.exploit-db.com/exploits/47066
exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5525.php
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-14765		Advisory
https://www.exploit-db.com/exploits/47066		exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5525.php		x_refsource_MISCExploitThird Party Advisory