CVE-2026-9774

Analyzed Analyzed - Analysis Complete

Directory Traversal and File Deletion in ATEN Unizon

Publication date: 2026-06-24

Last updated on: 2026-06-27

Assigner: Zero Day Initiative

Description

ATEN Unizon updateLicense Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateLicense method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files or create a denial-of-service condition on the system. Was ZDI-CAN-28502.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-06-27

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-13

NVD

CVE-2026-9774

EUVD

EUVD-2026-39112

Affected Vendors & Products

Vendor	Product	Version / Range
aten	unizon	to 2.7.264 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Compliance Impact

This vulnerability allows authenticated remote attackers to delete arbitrary files on affected ATEN Unizon installations, potentially leading to denial-of-service conditions.

While the CVE description does not explicitly mention compliance impacts, arbitrary file deletion and denial-of-service could affect the integrity and availability of data, which are important aspects of standards like GDPR and HIPAA.

Therefore, exploitation of this vulnerability could lead to non-compliance with regulations that require protection of data integrity and system availability.

Executive Summary

This vulnerability exists in the ATEN Unizon software within the updateLicense method. It is a directory traversal arbitrary file deletion flaw that allows remote attackers, who have authentication, to delete arbitrary files on affected systems. The root cause is the lack of proper validation of user-supplied file paths before performing file operations.

Impact Analysis

Exploiting this vulnerability can allow an attacker to delete arbitrary files on the affected system, potentially causing data loss or disruption of services. This can lead to a denial-of-service condition, impacting system availability and reliability.

Detection Guidance

This vulnerability involves exploitation of the updateLicense method via the /rest/system/license endpoint, where an authenticated user can perform directory traversal to delete arbitrary files.

Detection on your system could involve monitoring for unusual or unauthorized file deletion activities, especially those initiated through the /rest/system/license endpoint.

Since authentication is required, reviewing logs for authenticated requests to the updateLicense method or the /rest/system/license endpoint that include suspicious path traversal patterns (e.g., ../ sequences) may help identify exploitation attempts.

Specific commands are not provided in the available resources.

Mitigation Strategies

The primary mitigation step is to apply the security update released by ATEN, which fixes this vulnerability.

The fixed firmware version is FW V2.7.264.001, released on April 15, 2026.

Until the update is applied, restrict access to the /rest/system/license endpoint to trusted authenticated administrators only, and monitor for suspicious activity.

Hi! I’m here to help you understand CVE-2026-9774. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70