FaceSentry Access Control System 6.4.8 contains a cleartext password storage vulnerability that allows attackers to access unencrypted credentials in the devices SQLite database. Attackers can directly read sensitive login information stored in /faceGuard/database/FaceSentryWeb.sqlite without additional authentication.
Weakness
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Facesentry_access_control_system_firmware | Iwt | 5.7.0 (including) | 5.7.0 (including) |
| Facesentry_access_control_system_firmware | Iwt | 5.7.2 (including) | 5.7.2 (including) |
| Facesentry_access_control_system_firmware | Iwt | 6.4.8 (including) | 6.4.8 (including) |