CVE-2026-9775: ATEN Unizon Directory Traversal Arbitrary File Deletion

Technical summary

The vulnerability exists in ATEN Unizon's uploadSSL method, which fails to properly validate user-supplied file paths before performing file operations. This path traversal flaw (CWE-22) enables authenticated users to construct malicious path arguments using directory traversal sequences (such as '../' patterns) to access and delete files outside the intended directory scope. The lack of input sanitization allows an attacker to specify arbitrary locations on the filesystem for file deletion.

Business impact

Organizations deploying ATEN Unizon may experience service disruption if critical system or application files are deleted by an authenticated attacker. While the vulnerability requires valid credentials, a compromised user account or insider threat could weaponize this to sabotage operations, corrupt configurations, or trigger unplanned downtime. For environments relying on Unizon for device management or switching, file deletion could impact availability of essential functions.

Affected systems

ATEN Unizon is affected. Users should verify the exact version deployed in their environment against ATEN's official advisory to determine exposure. The vulnerability requires authentication, limiting attack surface to users or accounts with legitimate access to the system.

Exploitability

Exploitation requires valid authentication credentials, which significantly raises the barrier compared to unauthenticated attacks. An attacker must already have legitimate or compromised account access to the Unizon system. Once authenticated, the uploadSSL method can be called with maliciously crafted path parameters to delete files without further interaction, making exploitation straightforward for a privileged or compromised user.

Remediation

Apply the security patch released by ATEN for Unizon—verify the specific patched version against ATEN's official security advisory. The patch should implement proper input validation and path canonicalization in the uploadSSL method to prevent directory traversal. Restrict administrative and upload privileges to trusted personnel only, and implement network segmentation to limit who can access the Unizon management interface.

Patch guidance

Check ATEN's official security advisory for the specific patched version number and deployment instructions. Apply the update to all ATEN Unizon installations in your environment. Before patching production systems, validate the update in a test environment to ensure compatibility with your configuration and dependent systems. Document the patching process and verify successful remediation by confirming the uploadSSL method rejects traversal sequences in path inputs.

Detection guidance

Monitor authentication logs for unusual account activity or failed login attempts targeting Unizon administrative functions. Log and alert on uploadSSL method calls with path parameters containing directory traversal sequences (../, ..\ or URL-encoded variants like %2e%2e%2f). Compare filesystem change logs to identify unexpected file deletions, especially in system-critical directories. Organizations with EDR or filesystem monitoring should look for deletion events originating from Unizon processes with suspicious path patterns.

Why prioritize this

While the CVSS score of 6.5 (Medium) reflects the authentication requirement, the impact is significant: an authenticated attacker can delete arbitrary files, causing denial-of-service or system instability. Organizations should prioritize patching if Unizon is critical to operations, if user account security has been compromised, or if the system is accessible to a broad set of authenticated users. The authentication barrier provides some natural protection but should not delay patching in high-trust-boundary environments.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-accessible vulnerability with high integrity and availability impact (file deletion and DoS potential), offset by the requirement for authenticated access (PR:H). The vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H indicates no confidentiality risk, but significant risks to integrity and availability. The score is 'Medium' because exploitation depends on valid credentials, limiting real-world attack likelihood compared to unauthenticated flaws.

Frequently asked questions