Block Path Traversal Attacks on EyeLock nano NXT Biometric Devices

EyeLock nano NXT biometric access control devices running specific older firmware versions are vulnerable to a high-severity path traversal flaw. This weakness allows unauthenticated attackers to read arbitrary files on the local system by manipulating the 'path' parameter in GET requests. The vulnerability affects versions 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646.

The risk

The flaw, tracked as CVE-2016-20104, carries a CVSS score of 8.7, which rates it as high severity. It is classified under CWE-22. Attackers can send crafted GET requests to the /scripts/logdownload.php endpoint. By including directory traversal sequences such as ../../etc/passwd in the request, the application’s readfile() function returns the contents of sensitive local files without validation. This exposes critical system information to anyone with network access to the device.

Who is exposed

Organizations using EyeLock nano NXT hardware are at risk if they have not updated their firmware. The affected versions include 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646. These devices are often deployed in secure facilities for biometric authentication. Because the attack is unauthenticated, any network segment that can reach the device’s management interface is potentially exposed. The Shadowserver Foundation first observed evidence of exploitation for this specific vulnerability on October 19, 2023.

Cost and compliance

The source material does not provide details regarding financial costs, regulatory penalties, or specific compliance impacts associated with this vulnerability. There is no mention of data breaches resulting in monetary loss or specific industry regulations being violated due to the exposure of system files. The focus remains strictly on the technical existence and exploitation of the path traversal flaw in the identified firmware versions.

Our take on the response

Security teams must immediately audit their infrastructure for any EyeLock nano NXT devices running the affected firmware versions. Since exploitation evidence was observed in late 2023, organizations should prioritize isolating or updating these devices to prevent unauthorized access to local system files and sensitive configuration data.

What defenders should look for

Security operations teams should monitor web server logs for unusual GET requests targeting log download scripts. Look for sequences containing directory traversal characters like double dots and slashes in query parameters. Check for responses returning large amounts of text data from unexpected file paths, which may indicate successful file reads. If such activity is detected, immediately block the source IP address and restrict access to the device management interface to trusted networks only. Verify that no sensitive data was exfiltrated.

What to do and how to stay safe: EyeLock

• Inventory all EyeLock nano NXT devices to identify units running versions 3.05.1193, 3.04.1108, 3.03.944, or 3.01.646.
• Restrict network access to the device management interface, ensuring only authorized personnel can reach the /scripts/logdownload.php endpoint.
• Monitor web server logs for requests containing path traversal sequences such as ../../ to detect active exploitation attempts.
• Contact the vendor to inquire about available firmware updates that address the unvalidated input in the readfile() function.

Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific firmware versions of EyeLock nano NXT are vulnerable to CVE-2016-20104?

The affected versions are 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646.

How do attackers exploit this path traversal vulnerability?

Attackers send GET requests to /scripts/logdownload.php with traversal sequences in the 'path' parameter to read arbitrary local files.

When was exploitation of this vulnerability first observed?

The Shadowserver Foundation first observed exploitation evidence on October 19, 2023.