EUVD-2026-39116
GHSA-8584-g8g6-7rhx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privilege Unizon credentials
-
DeliveryReach ImportDeviceList over network
-
ExploitSubmit crafted traversal path
-
ExecutionWrite file outside intended directory
-
PersistExecute code as SYSTEM
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session with high privileges (CVSS PR:H) on ATEN Unizon and the ability to invoke the ImportDeviceList method, supplying a malicious file path that the feature fails to validate before performing file operations. The concrete prerequisite is access to the ImportDeviceList device-import functionality; the limiting factors are the high-privilege authentication requirement (an attacker must already be a privileged Unizon user or have compromised such an account) - there is no user interaction needed (UI:N) and the network attack vector (AV:N) means the management interface must be reachable from the attacker's position. This is not exploitable by an unauthenticated or low-privileged remote attacker against a default configuration. |
| Impact | The CVSS 3.0 base score is 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, meaning network-reachable and low-complexity but gated behind high privileges (PR:H) - an attacker must already hold administrative/high-privilege access to Unizon, which substantially narrows the realistic threat to insiders or attackers who have already compromised privileged credentials. Impact is severe (full C/I/A loss and SYSTEM-level code execution), but the PR:H prerequisite is the dominant limiting factor. No EPSS score was provided, the CVE is not in CISA KEV, and no public POC is referenced, so all available exploitation signals point to no active exploitation. The signals are internally consistent: a high-impact-but-high-privilege flaw reported through ZDI's coordinated disclosure, making it a patch-soon priority for Unizon operators rather than an emergency drop-everything issue - the main caveat is that the authentication barrier is meaningful only if Unizon admin accounts are well protected. |
| Exploit ScenarioDerived | An attacker who has obtained or abused high-privilege Unizon credentials submits a crafted ImportDeviceList request containing a traversal path (e.g., '../') that points outside the intended import directory, causing the service to write attacker-controlled content to a sensitive location. The planted file is then executed in the SYSTEM context, giving the attacker full control of the Unizon host. No public POC is currently referenced, but the low attack complexity makes weaponization straightforward once admin access is held. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 24, 2026
Authenticated remote code execution in ATEN Unizon arises from a directory traversal flaw in the ImportDeviceList method, where a user-supplied file path is used in file operations without proper validation. A high-privileged remote attacker can traverse outside intended directories to write or manipulate files and ultimately execute arbitrary code in the SYSTEM context, fully compromising the host. Discovered and reported via the Zero Day Initiative (ZDI-26-382 / ZDI-CAN-28579); no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Apply the fix described in the ATEN security advisory (https://www.aten.com/global/en/supportcenter/info/security-advisory/31/); patch available per vendor advisory, though an exact fixed version number was not present in the supplied data and should be confirmed directly from that advisory and ZDI-26-382 (https://www.zerodayinitiative.com/advisories/ZDI-26-382/). Until the update is deployed, reduce exposure by restricting network access to the Unizon management interface to trusted administrative networks or a management VLAN (trade-off: legitimate remote admins must use VPN/jump hosts), tightly limiting and auditing the high-privilege Unizon accounts required to reach the ImportDeviceList function since exploitation depends on PR:H access (trade-off: tighter account governance and possible workflow friction), and monitoring for anomalous import operations or unexpected file writes by the Unizon service. Because exploitation requires authenticated high-privilege access, rotating and strongly protecting admin credentials and enabling MFA on those accounts is an effective compensating control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ATEN Unizon is ATEN's centralized device/infrastructure management platform used to discover, monitor, and administer ATEN networked hardware (such as KVM-over-IP, PDU, and matrix devices). The vulnerability is a classic CWE-22 Improper Limitation of a Pathname to a Restricted Directory (path/directory traversal): the ImportDeviceList feature accepts a path parameter and uses it in file operations without canonicalizing or constraining it to an expected base directory, so sequences such as '../' or absolute paths let the attacker reference arbitrary filesystem locations. Because the service runs with elevated privileges, traversal-controlled file writes translate into code execution under the Windows SYSTEM account. The single CPE provided, cpe:2.3:a:aten:unizon:*:*:*:*:*:*:*:*, covers all versions without a fixed upper bound being specified in the intelligence.
Know when Unizon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
ImportDeviceList requires a high-privilege authenticated session (PR:H) but is network-reachable with no user interaction; path traversal yields SYSTEM code execution, so C/I/A:H.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
DescriptionCVE.org
ATEN Unizon ImportDeviceList Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability.
The specific flaw exists within the ImportDeviceList method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-28579.
Zero Day Initiative Advisories
Executive ViewAI
ATEN Unizon contains a high-severity directory traversal vulnerability (CVE-2026-9778) that permits authenticated remote code execution with SYSTEM-level privileges, enabling complete host compromise. An attacker with high-privilege access can exploit the ImportDeviceList method to write arbitrary files and gain full system control. Organizations operating ATEN Unizon for critical infrastructure or device management face immediate risk of operational takeover and should activate incident response procedures.
No vendor-released patch identified at time of analysis. Interim mitigations: Restrict network access to ATEN Unizon administrative interfaces to trusted management networks only; implement IP-based access controls and firewall rules; segment Unizon infrastructure from general user networks and sensitive data; enable real-time alerting and logging on ImportDeviceList method invocations; require multi-factor authentication for all administrative access; evaluate feasibility of running Unizon service with reduced privilege level (non-SYSTEM context).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Unauthenticated information disclosure in ATEN Unizon allows remote attackers to read arbitrary files from affected inst
Remote unauthenticated denial-of-service in ATEN Unizon lets attackers crash or hang the service by reaching the RpcProv
Authenticated remote code execution in ATEN Unizon arises from a directory traversal flaw in the restoreDB method, where
Authenticated remote code execution in ATEN Unizon stems from a broken cryptographic signature check in the updateWar me
Arbitrary file deletion via directory traversal in ATEN Unizon's uploadSSL method allows authenticated remote attackers
Arbitrary file deletion in ATEN Unizon exposes all installations to destructive denial-of-service attacks via a path tra
Exploit-DB