{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/eyelock/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:eyelock:nano_nxt:3.05.1193:*:*:*:*:*:*:*","cpe:2.3:a:eyelock:nano_nxt:3.04.1108:*:*:*:*:*:*:*","cpe:2.3:a:eyelock:nano_nxt:3.03.944:*:*:*:*:*:*:*","cpe:2.3:a:eyelock:nano_nxt:3.01.646:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2016-20104"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["nano NXT (3.05.1193, 3.04.1108, 3.03.944, 3.01.646)"],"_cs_severities":["high"],"_cs_tags":["path-traversal","iiot","information-disclosure"],"_cs_type":"threat","_cs_vendors":["EyeLock"],"content_html":"\u003cp\u003eEyeLock nano NXT biometric authentication devices (firmware versions 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646) are vulnerable to an unauthenticated path traversal vulnerability identified as CVE-2016-20104. The issue resides within the logdownload.php script, which fails to sanitize user-supplied input provided via the path parameter. By submitting a crafted GET request containing directory traversal sequences (such as ../), an attacker can access sensitive system files outside of the intended directory, such as /etc/passwd. The Shadowserver Foundation reported observing in-the-wild exploitation of this vulnerability starting on October 19, 2023. This is a high-severity flaw as it allows for information disclosure without authentication on edge-exposed biometric hardware.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2016-20104 allows unauthorized attackers to read arbitrary files from the EyeLock nano NXT device filesystem. This can lead to the exposure of sensitive configuration files, credential hashes, or system information, potentially facilitating further unauthorized access or device compromise in physical security environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAudit network perimeters to identify and restrict internet access to the web management interface of EyeLock nano NXT devices.\u003c/li\u003e\n\u003cli\u003eIf the devices are currently running vulnerable versions (3.05.1193, 3.04.1108, 3.03.944, or 3.01.646), prioritize applying the vendor-provided firmware security update to remediate CVE-2016-20104.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to monitor for exploitation attempts targeting the logdownload.php script.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-20T21:54:04Z","date_published":"2026-10-20T21:54:04Z","id":"https://feed.craftedsignal.io/briefs/2026-10-eyelock-path-traversal/","summary":"EyeLock nano NXT biometric devices contain a path traversal vulnerability in logdownload.php that allows unauthenticated attackers to read arbitrary system files via the path parameter.","title":"EyeLock nano NXT: Path traversal in logdownload.php (CVE-2016-20104)","url":"https://feed.craftedsignal.io/briefs/2026-10-eyelock-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - EyeLock","version":"https://jsonfeed.org/version/1.1"}