ZDI 2026-06-24

ZDI-26-382: ATEN Unizon ImportDeviceList Directory Traversal Remote Code Execution Vulnerability

CVE-2026-9778

Machine-generated analysis · WAYSCloud LLM

The vulnerability requires authentication and involves a directory traversal in the ImportDeviceList function of ATEN Unizon, potentially leading to remote code execution.

Context

The affected product is ATEN Unizon, a device management platform. The vulnerability is a directory traversal issue within the ImportDeviceList functionality that could allow remote code execution. The advisory notes that authentication is required to exploit the vulnerability. The CVSS score is rated at 7.2, indicating a medium to high severity impact.

Operator considerations

Check: Verify if ATEN Unizon is deployed and specifically review the ImportDeviceList function for exposure.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-9778.

Read the full advisory on ZDI →