A critical authenticated OS command injection vulnerability in iWT Ltd. FaceSentry Access Control System allows an authenticated attacker to execute arbitrary shell commands with root privileges.

This vulnerability is an OS command injection (CWE-78) occurring within the pingTest.php and tcpPortTest.php scripts. An authenticated user can manipulate the strInIP and strInPort parameters to inject and execute arbitrary shell commands as the root user.

Successful exploitation grants an attacker full root-level control over the FaceSentry appliance. This poses a severe risk to physical security infrastructure, as an attacker could potentially manipulate access control logs, bypass biometric authentication, or use the device as a pivot point to move laterally within the internal network. With a CVSS score of 8.8, this flaw represents a high-severity risk that could lead to complete system compromise and unauthorized physical facility access.

Immediate Action: Contact iWT Ltd. support or consult the vendor advisory to determine if a firmware update is available for your specific build. If no patch is provided, restrict network access to the web administration interface to trusted management subnets only.

Proactive Monitoring: Review web server access logs for suspicious POST requests to pingTest.php or tcpPortTest.php containing shell metacharacters such as backticks, semicolons, or pipe symbols.

Compensating Controls: Implement a Web Application Firewall (WAF) to inspect incoming POST requests and block traffic containing malicious shell injection patterns targeting these specific scripts.

Public Exploit Available: Yes, a functional proof-of-concept exploit exists and is documented in the ExploitDB record EDB-47064.

Given the high CVSS score and the availability of public exploit code, organizations utilizing FaceSentry systems must prioritize this vulnerability. Ensure that administrative interfaces are not exposed to the public internet and verify that access is restricted to authorized personnel only. If firmware updates are available from iWT Ltd., apply them immediately to neutralize the injection vector.