CVE-2016-20104

Deferred Deferred - Pending Action

Path Traversal in EyeLock nano NXT Firmware

Publication date: 2026-10-20

Last updated on: 2026-10-23

Assigner: VulnCheck

Description

EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the 'path' parameter. Attackers can send GET requests to /scripts/logdownload.php with traversal sequences like ../../etc/passwd, which readfile() returns unvalidated, disclosing local system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-23

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2016-20104

Affected Vendors & Products

Vendor	Product	Version / Range
EyeLock	nano NXT	3.05.1193
EyeLock	nano NXT	3.04.1108
EyeLock	nano NXT	3.03.944
EyeLock	nano NXT	3.01.646

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

EyeLock nano NXT versions 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 have a path traversal flaw in the 'path' parameter of the logdownload.php script. Unauthenticated attackers can exploit this by sending GET requests with sequences like ../../etc/passwd to read arbitrary files on the system. The readfile() function processes these paths without validation, exposing sensitive local files.

Detection Guidance

To detect this vulnerability, scan for systems running EyeLock nano NXT versions 3.05.1193, 3.04.1108, 3.03.944, or 3.01.646. Test for the path traversal flaw by sending a GET request to /scripts/logdownload.php with a traversal sequence like ../../etc/passwd and check if sensitive files are returned.

Impact Analysis

This vulnerability allows attackers to access sensitive system files without authentication, potentially exposing passwords, configurations, or other confidential data. It could lead to further attacks like privilege escalation or lateral movement within a network if combined with other flaws.

Compliance Impact

This vulnerability allows unauthenticated attackers to read arbitrary files on the system via path traversal. This could expose sensitive data such as configuration files, user credentials, or other confidential information, potentially violating data protection requirements under GDPR and HIPAA.

Mitigation Strategies

Immediately update EyeLock nano NXT to the latest patched version. If an update is unavailable, restrict access to /scripts/logdownload.php via network rules or firewall. Monitor for suspicious GET requests targeting this endpoint.

Hi! I’m here to help you understand CVE-2016-20104. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...