EUVD-2026-39112
GHSA-mj86-56mg-7pmq
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
PR:H confirmed by description and original vector; C:N because only deletion is possible; A:H reflects arbitrary file removal causing full host unavailability.
Primary rating from Vendor (zdi).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
ATEN Unizon updateLicense Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability.
The specific flaw exists within the updateLicense method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files or create a denial-of-service condition on the system. Was ZDI-CAN-28502.
AnalysisAI
Arbitrary file deletion in ATEN Unizon exposes all installations to destructive denial-of-service attacks via a path traversal flaw in the updateLicense method, reachable over the network by any authenticated high-privilege user. The CVSS PR:H constraint confirms exploitation requires high-privilege credentials, limiting opportunistic mass exploitation, but a motivated insider or attacker with stolen admin credentials can delete critical system files and render the host inoperable. No public exploit or CISA KEV listing has been identified at time of analysis, but the straightforward AC:L nature of the flaw means exploitation is trivial once credentials are obtained.
Technical ContextAI
ATEN Unizon is a centralized AV-over-IP and IT management platform by ATEN International. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), manifesting in the updateLicense method, which accepts a user-supplied file path and passes it to a file deletion operation without sanitizing directory traversal sequences such as '../'. The affected CPE is cpe:2.3:a:aten:unizon:*:*:*:*:*:*:*:*, indicating all known versions are vulnerable with no lower or upper version bound established from available data. Because the operation is restricted to file deletion - not read or write of attacker-controlled content - confidentiality exposure is nil and direct remote code execution is not achievable through this specific flaw alone.
RemediationAI
Consult the ATEN vendor security advisory at https://www.aten.com/global/en/supportcenter/info/security-advisory/27/ and apply any available patch immediately - no exact fixed version was confirmed from the available input data, so the advisory should be treated as the authoritative source for upgrade guidance. Until a patch is applied, restrict network access to the Unizon management interface using firewall rules or VPN-only policies to reduce the network-reachable attack surface, noting this does not protect against malicious authorized admins. Enforce multi-factor authentication on all high-privilege Unizon accounts to raise the bar for credential-based attacks. Enable filesystem-level auditing and alerting on unexpected file deletions on the Unizon host to detect exploitation attempts. The ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-378/ may contain additional vendor-coordinated remediation details.
Unauthenticated information disclosure in ATEN Unizon allows remote attackers to read arbitrary files from affected inst
Remote unauthenticated denial-of-service in ATEN Unizon lets attackers crash or hang the service by reaching the RpcProv
Authenticated remote code execution in ATEN Unizon arises from a directory traversal flaw in the ImportDeviceList method
Authenticated remote code execution in ATEN Unizon arises from a directory traversal flaw in the restoreDB method, where
Authenticated remote code execution in ATEN Unizon stems from a broken cryptographic signature check in the updateWar me
Arbitrary file deletion via directory traversal in ATEN Unizon's uploadSSL method allows authenticated remote attackers
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today