CVE-2026-9775 - ATEN Unizon uploadSSL Directory Traversal Arbitrary File Deletion Vulnerability

Back Back to CVE browser

MEDIUM

ATEN Unizon uploadSSL Directory Traversal Arbitrary File Deletion Vulnerability

Published Jun 24, 2026

6.5

MEDIUM

CVSS 3.1

EPSS 1.51%

Description

ATEN Unizon uploadSSL Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability.

The specific flaw exists within the uploadSSL method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files or create a denial-of-service condition on the system. Was ZDI-CAN-28503.

Affected products

Vendor ATEN Product Unizon Default
n/a
- Version
  2.7.262.002
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

ATEN

Unizon

n/a

Version	Status	Constraints
2.7.262.002	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-39113
Advisory
https://www.aten.com/global/en/supportcenter/info/security-advisory/28/
vendor-advisoryVendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-26-379/
x_research-advisoryThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-39113		Advisory
https://www.aten.com/global/en/supportcenter/info/security-advisory/28/		vendor-advisoryVendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-26-379/		x_research-advisoryThird Party Advisory