FaceSentry Access Control System 6.4.8 Remote SSH Root Access

Posted on 01 July 2019

FaceSentry Access Control System version 6.4.8 facial biometric access control appliance ships with hard-coded and weak credentials for SSH access on port 23445 using the credentials wwwuser:123456. The root privilege escalation is done by abusing the insecure sudoers entry file.