CVE-2026-9779

HIGH

ATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Execution Vulnerability

Title source: cna
STIX 2.1

Description

ATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateWar method. The issue results from an incorrect implementation of cryptographic signature verification. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-28590.

References (2)

Core 2
Core References
X_Research Advisory x_research-advisory
ZDI-26-383
https://www.zerodayinitiative.com/advisories/ZDI-26-383/
Vendor Advisory vendor-advisory
vendor-provided URL
https://www.aten.com/global/en/supportcenter/info/security-advisory/32/

Scores

CVSS v3 7.2
EPSS 0.0038
EPSS Percentile 29.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-347
Status published
Products (2)
aten/unizon < 2.7.264
ATEN/Unizon 2.6.253.001
Published Jun 24, 2026
Tracked Since Jun 25, 2026