EyeLock Biometric Devices Exposed to Unauthenticated File Theft

EyeLock nano NXT biometric devices running versions 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 are vulnerable to a high-severity path traversal issue. The flaw, tracked as CVE-2016-20104, has a CVSS score of 8.7. Attackers do not need credentials to exploit this weakness. They can read sensitive system files by sending crafted requests to the device. No patch has been confirmed by the vendor in the source material.

How it unfolded

• The Shadowserver Foundation observed evidence of exploitation for this vulnerability on October 19, 2023.
• The flaw exists in the 'path' parameter of the /scripts/logdownload.php script on affected devices.
• Attackers use traversal sequences like ../../etc/passwd to bypass validation and read local files.

Who is affected

Organizations using EyeLock nano NXT hardware with firmware versions 3.05.1193, 3.04.1108, 3.03.944, or 3.01.646 are at risk. The vulnerability is classified as CWE-22, indicating a path traversal error. Because the attack requires no authentication, any device accessible from the internet or an untrusted network segment is exposed. The readfile() function returns the data without validating the input, allowing disclosure of local system files.

Our take on the response

That suggests network segmentation is the primary defense until a vendor update arrives. The unauthenticated nature of the attack means that perimeter defenses are critical. As Patch Observer reported on 2026-10-15, QNAP released QuMagie 2.9.1 to fix a similar high-severity path traversal flaw for admins, highlighting the ongoing relevance of this vulnerability class. However, unlike that QNAP issue which required authentication, this EyeLock flaw is easier to exploit.

Who needs to act first

Teams should prioritize isolating exposed biometric devices from general network traffic. Check whether these devices are directly reachable from untrusted networks. If possible, restrict access to the management interface using strict firewall rules. Verify that no public-facing endpoints serve the logdownload.php script. Monitor logs for unusual file access patterns. Ensure that configuration backups are secure and up to date before making changes. Limit administrative access to trusted IPs only.

Background: Firewall rules

Firewall rules Linux systems use are ordered instructions that decide whether network packets enter or leave. They inspect source, destination, and protocol data. You must configure these rules to allow necessary services while blocking unauthorized access attempts.

Read the full guide: Firewall Rules Linux: How Packet Filtering Shapes Network Security

What to do and how to stay safe: EyeLock

• Audit your network for EyeLock nano NXT devices running the four affected firmware versions.
• Block external access to the /scripts/logdownload.php endpoint using web application firewalls or network ACLs.
• Monitor web server logs for requests containing directory traversal sequences like ../ or ..\
• Restrict access to biometric device management interfaces to internal administrative networks only.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2016-20104?

The CVSS score is 8.7, which is rated as HIGH severity.

Do attackers need credentials to exploit this flaw?

No, the vulnerability allows unauthenticated attackers to read arbitrary files.

Which EyeLock nano NXT versions are affected?

Versions 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 are affected.