iWT FaceSentry Access Control System Cleartext Transmission Vulnerability Allowing Authentication Credential Interception

A vulnerability in iWT FaceSentry Access Control System version 6.4.8 has been identified, allowing remote attackers to intercept authentication credentials due to cleartext transmission of sensitive information. This vulnerability enables man-in-the-middle attacks to capture HTTP cookie authentication data during network communication.

Impact

Exploitation of this vulnerability could lead to unauthorized interception of HTTP cookie authentication credentials, allowing attackers to bypass authentication mechanisms.

Reproduction

The vulnerability can be reproduced by sending a crafted HTTP request that exploits the cleartext transmission of data. This can be done using a man-in-the-middle attack technique, intercepting the network traffic between the client and the server. The captured traffic will reveal the HTTP cookies containing the authentication credentials.