EUVD-2026-39113
GHSA-cxx8-7x7p-5ccv
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Network-reachable uploadSSL endpoint but requires high-privilege authentication (PR:H); file deletion yields high availability impact (A:H) and minimal integrity effect (I:L) with no confidentiality exposure.
Primary rating from Vendor (zdi).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
ATEN Unizon uploadSSL Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability.
The specific flaw exists within the uploadSSL method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files or create a denial-of-service condition on the system. Was ZDI-CAN-28503.
AnalysisAI
Arbitrary file deletion via directory traversal in ATEN Unizon's uploadSSL method allows authenticated remote attackers with high-privilege credentials to delete files anywhere on the underlying filesystem. All versions are indicated as affected by the wildcard CPE. Exploitation can be used to destroy configuration or system files, inducing a denial-of-service condition; no confirmed active exploitation or public exploit code has been identified at time of analysis.
Technical ContextAI
ATEN Unizon is a network management platform. The vulnerable component is the uploadSSL method, which handles SSL certificate uploads. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal): the application fails to sanitize or canonicalize user-supplied path data before passing it to file operation functions, allowing traversal sequences such as '../../' to escape the intended directory. The CPE string cpe:2.3:a:aten:unizon:*:*:*:*:*:*:*:* uses a wildcard version field, indicating all tracked Unizon releases are affected. The CVSS:3.0 vector AV:N/AC:L/PR:H/UI:N/S:U confirms the endpoint is network-accessible, exploitation complexity is low once credentials are held, and the scope does not extend beyond the vulnerable system.
RemediationAI
Consult the ATEN vendor security advisory at https://www.aten.com/global/en/supportcenter/info/security-advisory/28/ and apply any vendor-released firmware or software update; an exact patched version number is not confirmed in the available input data, so the advisory should be checked directly for version-specific guidance. As a compensating control, restrict network access to the Unizon management interface to only trusted administrator workstations via firewall ACLs or network segmentation, reducing the attack surface even though exploitation already requires high-privilege credentials. Enforce the principle of least privilege by auditing which accounts hold high-privilege roles in Unizon, and rotate credentials for any accounts that may have been exposed. Monitor filesystem integrity and access logs on Unizon hosts for unexpected file deletions as a detection measure. Note that network-layer controls reduce exposure but do not remediate the underlying path traversal flaw.
Unauthenticated information disclosure in ATEN Unizon allows remote attackers to read arbitrary files from affected inst
Remote unauthenticated denial-of-service in ATEN Unizon lets attackers crash or hang the service by reaching the RpcProv
Authenticated remote code execution in ATEN Unizon arises from a directory traversal flaw in the ImportDeviceList method
Authenticated remote code execution in ATEN Unizon arises from a directory traversal flaw in the restoreDB method, where
Authenticated remote code execution in ATEN Unizon stems from a broken cryptographic signature check in the updateWar me
Arbitrary file deletion in ATEN Unizon exposes all installations to destructive denial-of-service attacks via a path tra
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today