Description
EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the 'path' parameter. Attackers can send GET requests to /scripts/logdownload.php with traversal sequences like ../../etc/passwd, which readfile() returns unvalidated, disclosing local system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Published: 2026-10-20
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Local File Disclosure via Path Traversal
Action: Apply Patch
AI Analysis

Impact

A path traversal vulnerability exists in EyeLock nano NXT through the logdownload.php script. An unauthenticated attacker can supply a crafted path parameter to read any file on the server, exposing sensitive data such as credentials or configuration files. This flaw is classified as CWE-22 and can result in confidentiality compromise and potential escalation for future attacks.

Affected Systems

EyeLock nano NXT firmware versions 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 are affected. Operators using these firmware releases on the device are at risk.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Attackers can trigger the flaw by sending a GET request to /scripts/logdownload.php with traversal sequences such as ../../etc/passwd. No authentication is required, so the vulnerability can be exploited from any network location that can reach the device. The known exploitation evidence from 2023 suggests that attackers have successfully accessed the flaw, indicating a tangible threat to exposed systems.

Generated by OpenCVE AI on October 20, 2026 at 21:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest firmware patch released by EyeLock that removes the vulnerable logdownload.php endpoint.
  • If an immediate patch is unavailable, block or restrict HTTP access to /scripts/logdownload.php by configuring the web server or firewall to deny all requests or require authentication.
  • Implement input validation or path sanitization in the application to reject traversal characters before passing them to readfile().
  • Monitor web server logs for unexpected file download attempts and consider deploying an IDS/IPS to detect suspicious patterns.

Generated by OpenCVE AI on October 20, 2026 at 21:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 24 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Eyelock
Eyelock nano Nxt
Vendors & Products Eyelock
Eyelock nano Nxt

Tue, 20 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Description EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the 'path' parameter. Attackers can send GET requests to /scripts/logdownload.php with traversal sequences like ../../etc/passwd, which readfile() returns unvalidated, disclosing local system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Title EyeLock nano NXT 3.05.1193 Path Traversal via logdownload.php
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Eyelock Nano Nxt
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-23T15:15:18.506Z

Reserved: 2026-10-14T20:25:24.894Z

Link: CVE-2016-20104

cve-icon Vulnrichment

Updated: 2026-10-23T15:14:35.057Z

cve-icon NVD

Status : Deferred

Published: 2026-10-20T21:17:14.193

Modified: 2026-10-23T16:16:50.360

Link: CVE-2016-20104

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T14:59:46Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')