EUVD-2026-39117
GHSA-2h8c-cmrc-4q5c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privilege Unizon credentials
-
DeliveryAuthenticate to management interface
-
ExploitSubmit forged WAR update package
-
ExecutionBypass flawed signature check in updateWar
-
PersistDeploy malicious application
-
ImpactExecute arbitrary code as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Signature verification
|
| Exploitation Conditions | Exploitation requires an authenticated session with high privileges on ATEN Unizon (CVSS PR:H) plus network access to the management interface exposing the updateWar update functionality. The attacker must be able to submit a crafted WAR/update package to trigger the flawed cryptographic signature verification in the updateWar method. Limiting factors: the high-privilege authentication requirement (the attacker must already hold admin/operator-level access) and the need to reach the management application over the network. No victim user interaction is required (UI:N) and attack complexity is low (AC:L), so once privileged access exists, exploitation is reliable. |
| Impact | Signals are moderate and internally consistent. The CVSS 3.0 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2 High) shows network reach with low complexity and no user interaction, but PR:H - exploitation requires high privileges, which is the primary risk dampener and explains why this rates High rather than Critical. No EPSS score is present in the provided data and the CVE is not on CISA KEV, so there is no confirmed active exploitation; no POC is referenced. Realistic risk is therefore conditional: an attacker who already holds an administrative/operator account on Unizon can escalate to full SYSTEM-level code execution, making this most relevant as a post-authentication host-takeover primitive or an insider/compromised-credential threat rather than a mass-exploitable internet-facing flaw. Net priority: meaningful for organizations exposing Unizon management interfaces, but gated behind existing privileged access. |
| Exploit ScenarioDerived | An attacker who has obtained valid high-privilege Unizon credentials (via phishing, credential reuse, or insider access) logs into the management interface and submits a maliciously crafted WAR update package. Because the updateWar signature verification is flawed, the forged package passes validation and is deployed, executing the attacker's code as SYSTEM and granting full control of the appliance. No public exploit is identified at time of analysis, though the low attack complexity makes weaponization straightforward for a skilled actor. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 24, 2026
Authenticated remote code execution in ATEN Unizon stems from a broken cryptographic signature check in the updateWar method (reachable via doCryptoHugeFileToFile), letting a high-privileged remote attacker push a forged WAR update and run arbitrary code as SYSTEM. The flaw (CWE-347) was reported by Trend Micro ZDI as ZDI-CAN-28590 and carries a CVSS 3.0 base score of 7.2; no public exploit identified at time of analysis.
RemediationAI
Apply the fixed release referenced in ATEN's security advisory (https://www.aten.com/global/en/supportcenter/info/security-advisory/32/) once the exact build is identified - Patch available per vendor advisory, but no specific fix version is given in the provided data, so verify the patched version directly with ATEN. Until patched, restrict network access to the Unizon management interface to a dedicated administrative VLAN behind a VPN, which limits who can reach the vulnerable updateWar endpoint at the cost of remote administrative convenience. Tighten privileged accounts (rotate credentials, enforce MFA, remove unnecessary admin/operator roles) since exploitation requires high privileges; this reduces but does not eliminate risk from a legitimately compromised admin. As a detective control, monitor for unexpected WAR/application update uploads and anomalous SYSTEM-context process creation. Cross-reference the ZDI advisory (https://www.zerodayinitiative.com/advisories/ZDI-26-383/) for further detail.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ATEN Unizon is ATEN's centralized management platform for KVM/console and data-center access appliances, built as a Java web application (evidenced by the WAR-file update mechanism). The vulnerability is a CWE-347 Improper Verification of Cryptographic Signature: the updateWar routine is meant to validate the digital signature of an uploaded application/firmware update package before deploying it, but the verification is implemented incorrectly. Because the tags reference a 'Jwt Attack', the integrity check likely relies on a JWT or token-based signature that can be bypassed (e.g., algorithm confusion, unverified signature, or an attacker-controlled key). The affected CPE is cpe:2.3:a:aten:unizon for all enumerated versions. Since the deployed WAR executes in the context of the Java service account, which runs as SYSTEM, a forged package yields full host compromise.
Know when Unizon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable management endpoint (AV:N, AC:L) but invoking updateWar requires high-privilege authentication (PR:H); a forged update yields full SYSTEM code execution, so C/I/A all High.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
DescriptionCVE.org
ATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability.
The specific flaw exists within the updateWar method. The issue results from an incorrect implementation of cryptographic signature verification. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-28590.
Zero Day Initiative Advisories
Executive ViewAI
ATEN Unizon is vulnerable to authenticated remote code execution due to a broken cryptographic signature verification flaw that allows high-privileged attackers to deploy malicious updates and achieve SYSTEM-level code execution. Organizations deploying Unizon face the risk of complete platform compromise if an insider or network-adjacent attacker obtains administrative credentials. With no vendor patch currently available, this vulnerability requires immediate compensating controls to mitigate exposure.
Network segmentation to restrict Unizon administrative access; disable remote update mechanisms where operationally feasible; enforce multi-factor authentication for all high-privileged accounts; implement tamper detection on update packages; monitor for unauthorized configuration changes and code execution events; maintain detailed audit logs of administrative activities for forensic analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Unauthenticated information disclosure in ATEN Unizon allows remote attackers to read arbitrary files from affected inst
Remote unauthenticated denial-of-service in ATEN Unizon lets attackers crash or hang the service by reaching the RpcProv
Authenticated remote code execution in ATEN Unizon arises from a directory traversal flaw in the ImportDeviceList method
Authenticated remote code execution in ATEN Unizon arises from a directory traversal flaw in the restoreDB method, where
Arbitrary file deletion via directory traversal in ATEN Unizon's uploadSSL method allows authenticated remote attackers
Arbitrary file deletion in ATEN Unizon exposes all installations to destructive denial-of-service attacks via a path tra
Exploit-DB