ATEN Unizon EUVD-2026-39113

Exploitation requires valid high-privilege (administrator-level) credentials to the ATEN Unizon management interface, as confirmed by CVSS PR:H and explicitly stated in the description ('Authentication is required to exploit this vulnerability'). The vulnerable code path is triggered specifically through the uploadSSL method when an authenticated request is submitted with a user-controlled path value containing traversal sequences. The attack is reachable over the network (AV:N) with no user interaction (UI:N) beyond the attacker's own request. Exploitation is concretely limited by the high-privilege authentication requirement: unauthenticated actors and low-privilege users cannot directly reach the vulnerable code path without first obtaining administrator-level access. There is no reported requirement for a specific non-default configuration beyond having a functional Unizon deployment.

The CVSS base score of 5.5 (Medium) accurately reflects the elevated authentication barrier (PR:H), which is the primary risk-limiting factor. The impact profile is asymmetric: no confidentiality exposure (C:N), low integrity impact (I:L), but high availability impact (A:H), consistent with a file deletion primitive that can destroy system state but cannot exfiltrate data. No CISA KEV listing and no reported POC availability both point to no confirmed opportunistic exploitation at time of analysis, consistent with a finding that requires privileged access and was disclosed through ZDI's coordinated disclosure process (ZDI-CAN-28503). The low attack complexity (AC:L) means that once high-privilege credentials are obtained - through credential theft, reuse, or brute force - exploitation is trivial with no special setup. Realistically this is a medium-priority patching item: the privileged access prerequisite is a meaningful barrier, but the wildcard CPE indicates no version is exempt, and successful exploitation can cause full service disruption.

An attacker who has obtained high-privilege Unizon administrator credentials - whether through phishing, credential reuse, or a separate compromise - sends a crafted HTTP request to the uploadSSL endpoint with directory traversal sequences embedded in the path parameter, such as '../../etc/passwd' or targeting Unizon service files. The server, lacking proper path validation, processes the deletion against the traversed target outside the intended upload directory. Repeated or targeted deletions can crash the Unizon service or corrupt its configuration, achieving denial of service. No public exploit code has been identified at time of analysis.