EUVD-2026-39116
GHSA-8584-g8g6-7rhx
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
ImportDeviceList requires a high-privilege authenticated session (PR:H) but is network-reachable with no user interaction; path traversal yields SYSTEM code execution, so C/I/A:H.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
1DescriptionCVE.org
ATEN Unizon ImportDeviceList Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability.
The specific flaw exists within the ImportDeviceList method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-28579.
AnalysisAI
Authenticated remote code execution in ATEN Unizon arises from a directory traversal flaw in the ImportDeviceList method, where a user-supplied file path is used in file operations without proper validation. A high-privileged remote attacker can traverse outside intended directories to write or manipulate files and ultimately execute arbitrary code in the SYSTEM context, fully compromising the host. Discovered and reported via the Zero Day Initiative (ZDI-26-382 / ZDI-CAN-28579); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
ATEN Unizon is ATEN's centralized device/infrastructure management platform used to discover, monitor, and administer ATEN networked hardware (such as KVM-over-IP, PDU, and matrix devices). The vulnerability is a classic CWE-22 Improper Limitation of a Pathname to a Restricted Directory (path/directory traversal): the ImportDeviceList feature accepts a path parameter and uses it in file operations without canonicalizing or constraining it to an expected base directory, so sequences such as '../' or absolute paths let the attacker reference arbitrary filesystem locations. Because the service runs with elevated privileges, traversal-controlled file writes translate into code execution under the Windows SYSTEM account. The single CPE provided, cpe:2.3:a:aten:unizon:*:*:*:*:*:*:*:*, covers all versions without a fixed upper bound being specified in the intelligence.
RemediationAI
Apply the fix described in the ATEN security advisory (https://www.aten.com/global/en/supportcenter/info/security-advisory/31/); patch available per vendor advisory, though an exact fixed version number was not present in the supplied data and should be confirmed directly from that advisory and ZDI-26-382 (https://www.zerodayinitiative.com/advisories/ZDI-26-382/). Until the update is deployed, reduce exposure by restricting network access to the Unizon management interface to trusted administrative networks or a management VLAN (trade-off: legitimate remote admins must use VPN/jump hosts), tightly limiting and auditing the high-privilege Unizon accounts required to reach the ImportDeviceList function since exploitation depends on PR:H access (trade-off: tighter account governance and possible workflow friction), and monitoring for anomalous import operations or unexpected file writes by the Unizon service. Because exploitation requires authenticated high-privilege access, rotating and strongly protecting admin credentials and enabling MFA on those accounts is an effective compensating control.
Unauthenticated information disclosure in ATEN Unizon allows remote attackers to read arbitrary files from affected inst
Remote unauthenticated denial-of-service in ATEN Unizon lets attackers crash or hang the service by reaching the RpcProv
Authenticated remote code execution in ATEN Unizon arises from a directory traversal flaw in the restoreDB method, where
Authenticated remote code execution in ATEN Unizon stems from a broken cryptographic signature check in the updateWar me
Arbitrary file deletion via directory traversal in ATEN Unizon's uploadSSL method allows authenticated remote attackers
Arbitrary file deletion in ATEN Unizon exposes all installations to destructive denial-of-service attacks via a path tra
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today