EyeLock nano NXT: Path traversal in logdownload.php (CVE-2016-20104)

EyeLock nano NXT biometric authentication devices (firmware versions 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646) are vulnerable to an unauthenticated path traversal vulnerability identified as CVE-2016-20104. The issue resides within the logdownload.php script, which fails to sanitize user-supplied input provided via the path parameter. By submitting a crafted GET request containing directory traversal sequences (such as ../), an attacker can access sensitive system files outside of the intended directory, such as /etc/passwd. The Shadowserver Foundation reported observing in-the-wild exploitation of this vulnerability starting on October 19, 2023. This is a high-severity flaw as it allows for information disclosure without authentication on edge-exposed biometric hardware.

Impact

Successful exploitation of CVE-2016-20104 allows unauthorized attackers to read arbitrary files from the EyeLock nano NXT device filesystem. This can lead to the exposure of sensitive configuration files, credential hashes, or system information, potentially facilitating further unauthorized access or device compromise in physical security environments.

Recommendation

1. Audit network perimeters to identify and restrict internet access to the web management interface of EyeLock nano NXT devices.
2. If the devices are currently running vulnerable versions (3.05.1193, 3.04.1108, 3.03.944, or 3.01.646), prioritize applying the vendor-provided firmware security update to remediate CVE-2016-20104.
3. Deploy the provided Sigma rule to monitor for exploitation attempts targeting the logdownload.php script.