ATEN Unizon CVE-2026-9777

Exploitation requires authenticated access to ATEN Unizon at a high privilege level (CVSS PR:H) and the ability to invoke the restoreDB method, which performs database/backup restore file operations using a user-supplied path. The concrete prerequisite is reaching that restore function with a crafted traversal path; the concrete limiting factor is the high-privilege authentication gate - this is not exploitable by anonymous or low-privileged users. No user interaction is required (UI:N) and the vector is network-reachable (AV:N), so once an attacker holds Unizon admin credentials the barrier to SYSTEM-level code execution is low. Practical limits: the attacker must possess valid administrative Unizon credentials and network access to the management interface.

The CVSS 3.0 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 7.2 High) shows a network-reachable, low-complexity attack with full confidentiality/integrity/availability impact, but gated behind PR:H - the attacker must already hold high privileges (administrative authentication) on the Unizon application. That authentication requirement is the dominant risk-limiting factor and explains why this rates High rather than Critical. No EPSS score, KEV listing, or POC was provided in the input, so exploitation probability cannot be quantified from data; the absence of KEV and POC means there is no public exploit identified at time of analysis. Net assessment: a real and high-impact issue (RCE as SYSTEM) but not a mass-exploitation candidate - realistic risk is highest where Unizon admin credentials are weak, shared, or already compromised, making this a privilege-to-SYSTEM pivot rather than an unauthenticated internet-wide threat. No conflicting signals were detected between the vector and the description; both consistently indicate authenticated remote exploitation.

An attacker who has obtained or been granted high-privilege (administrative) access to the ATEN Unizon web interface invokes the restoreDB function with a database/backup path containing directory-traversal sequences. Because the path is not validated and the service runs as SYSTEM, the crafted restore writes attacker-controlled content to a sensitive filesystem location, yielding arbitrary code execution as SYSTEM. No public exploit code was identified at time of analysis, and the low attack complexity (AC:L) means a knowledgeable authenticated attacker could reproduce it reliably.