All vulnerabilities
CVE-2016-20104

EyeLock nano NXT 3.05.1193 Path Traversal via logdownload.php

EyeLock nano NXT
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 23 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.39%Chance of exploitation activity in the next 30 days, higher than 31% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published20 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the 'path' parameter. Attackers can send GET requests to /scripts/logdownload.php with traversal sequences like ../../etc/passwd, which readfile() returns unvalidated, disclosing local system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

Text from CVE List

Affected versions 4

  • nano NXTaffected: 3.05.1193CVE List
  • nano NXTaffected: 3.04.1108CVE List
  • nano NXTaffected: 3.03.944CVE List
  • nano NXTaffected: 3.01.646CVE List

References 5