CVE-2026-9778

HIGH

ATEN Unizon ImportDeviceList Directory Traversal Remote Code Execution Vulnerability

Title source: cna
STIX 2.1

Description

ATEN Unizon ImportDeviceList Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability. The specific flaw exists within the ImportDeviceList method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-28579.

References (2)

Core 2
Core References
X_Research Advisory x_research-advisory
ZDI-26-382
https://www.zerodayinitiative.com/advisories/ZDI-26-382/
Vendor Advisory vendor-advisory
vendor-provided URL
https://www.aten.com/global/en/supportcenter/info/security-advisory/31/

Scores

CVSS v3 7.2
EPSS 0.0148
EPSS Percentile 70.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-22
Status published
Products (2)
aten/unizon < 2.7.264
ATEN/Unizon 2.7.262.002
Published Jun 24, 2026
Tracked Since Jun 25, 2026