EUVD-2026-50499
GHSA-38fr-fpg3-22rf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable RPC endpoint with no authentication (AV:N/PR:N) and low complexity; impact is availability-only DoS (A:H), with no confidentiality or integrity effect.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
2DescriptionCVE.org
ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ATEN Unizon. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the RpcProvider class. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-29041.
AnalysisAI
Remote unauthenticated denial-of-service in ATEN Unizon lets attackers crash or hang the service by reaching the RpcProvider class, which exposes functionality without any authentication check (CWE-306). Any network-reachable attacker can send requests that trigger the availability impact without credentials or user interaction. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but it was discovered and reported through Trend Micro's Zero Day Initiative (ZDI-CAN-29041 / ZDI-26-272).
Technical ContextAI
ATEN Unizon is ATEN's centralized management/monitoring platform used to administer ATEN networked AV and KVM-over-IP hardware. The vulnerable component is the RpcProvider class, which handles remote procedure call functionality but performs no authentication before granting access to that functionality. CWE-306 (Missing Authentication for Critical Function) captures the root cause: a sensitive RPC surface is exposed on the network to anyone who can reach it, so requests that should require an authenticated session are processed directly. Per the CPE (cpe:2.3:a:aten:unizon:*), all versions of the Unizon application are flagged pending vendor version scoping.
RemediationAI
Patch available per vendor advisory - apply the fixed ATEN Unizon build referenced in ATEN's security advisory (https://www.aten.com/global/en/supportcenter/info/security-advisory/26/); the exact fixed version is not specified in the provided data, so confirm the target build against that advisory and the ZDI advisory (https://www.zerodayinitiative.com/advisories/ZDI-26-272/). Until patched, restrict network reachability of the Unizon management service: place it on an isolated management VLAN, apply firewall/ACL rules to permit the RpcProvider/RPC listener port only from trusted administrative hosts, and require VPN access for remote administration. These network controls reduce exposure without altering application behavior, but do not fix the missing authentication itself, so any host permitted to reach the service can still trigger the DoS - keep the allow-list as narrow as possible.
Unauthenticated information disclosure in ATEN Unizon allows remote attackers to read arbitrary files from affected inst
Authenticated remote code execution in ATEN Unizon arises from a directory traversal flaw in the ImportDeviceList method
Authenticated remote code execution in ATEN Unizon arises from a directory traversal flaw in the restoreDB method, where
Authenticated remote code execution in ATEN Unizon stems from a broken cryptographic signature check in the updateWar me
Arbitrary file deletion via directory traversal in ATEN Unizon's uploadSSL method allows authenticated remote attackers
Arbitrary file deletion in ATEN Unizon exposes all installations to destructive denial-of-service attacks via a path tra
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today