EyeLock nano NXT: Path traversal in logdownload.php allows file disclosure
Summary
EyeLock nano NXT iris-recognition devices in firmware 3.05.1193, 3.04.1108, 3.03.944 and 3.01.646 contain a path traversal flaw in the 'path' parameter of /scripts/logdownload.php. An unauthenticated attacker can send crafted GET requests to read arbitrary local files, such as /etc/passwd, which may expose system files and stored configuration data. The attack requires only network access to the device's web interface.
Affected
- EyeLock nano NXT firmware 3.05.1193
- EyeLock nano NXT firmware 3.04.1108
- EyeLock nano NXT firmware 3.03.944
- EyeLock nano NXT firmware 3.01.646
- Other versions: Unknown.
Fixed in
Unknown. No vendor advisory or fixed firmware version has been confirmed for CVE-2016-20104.
Workaround
- Vendor-confirmed mitigations: none found.
- Restrict access to the device's web interface to a management VLAN or specific admin hosts.
- Block access to /scripts/logdownload.php at the firewall or reverse proxy where feasible.
- Remove the device from any internet-facing path.
Exploitation
- Public proof of concept: yes (Exploit-DB EDB-40227, 2016; Nuclei detection template).
- Exploitation in the wild: reported by the Shadowserver Foundation (first observed 2023-10-19), but sources conflict on whether it is listed as known exploited. Verify against the CISA KEV catalogue.
- CISA SSVC: Exploitation 'poc', automatable: yes, technical impact: partial.
Our recommendation
- Identify all EyeLock nano NXT devices and their firmware versions.
- Check whether logdownload.php is reachable from networks other than management hosts, and isolate the device if it is.
- Ask EyeLock support in writing for a fixed firmware and an advisory reference for CVE-2016-20104.
- Review and rotate any credentials or certificates stored on the device if it may have been reachable.
- Because the product is discontinued, plan a replacement if no fix is available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Exploit-DB EDB-40227 www.exploit-db.com
- VulnCheck advisory www.vulncheck.com
- Zero Science Lab ZSL-2016-5356 www.zeroscience.mk
- Nuclei template eyelock-nano-lfd github.com
- Packet Storm packetstorm.news
- NVD via Vulners vulners.com
- OpenCVE CVE-2016-20104 app.opencve.io
- EyeLock software downloads eyelock.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:23.
Original description (NVD)
EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the 'path' parameter. Attackers can send GET requests to /scripts/logdownload.php with traversal sequences like ../../etc/passwd, which readfile() returns unvalidated, disclosing local system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
NVD references (6)
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/eyelock-nano-lfd.ya…
- https://packetstorm.news/files/id/138274/
- https://www.exploit-db.com/exploits/40227
- https://www.vulncheck.com/advisories/eyelock-nano-nxt-3.05.1193-path-traversal-via-logdownload-php
- https://www.zeroscience.mk/advisories/ZSL-2016-5356.html
- https://www.zeroscience.mk/advisories/ZSL-2016-5356.html
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.