CVE-2026-9777: ATEN Unizon Directory Traversal RCE Vulnerability Analysis

Technical summary

CVE-2026-9777 is a CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) vulnerability affecting ATEN Unizon. The restoreDB method fails to properly validate user-supplied file paths before using them in file operations, enabling directory traversal attacks. An authenticated attacker can exploit this to write arbitrary files to unintended locations and achieve remote code execution in the SYSTEM security context. The vulnerability has a CVSS 3.0 score of 7.2 (HIGH) with a vector of CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, reflecting network accessibility, low attack complexity, high privileges required, and full impact on confidentiality, integrity, and availability.

Business impact

Compromise of ATEN Unizon installations could allow an insider or an attacker who has obtained administrative credentials to gain complete system control. Since exploitation runs code as SYSTEM, the attacker gains the highest privilege level on Windows systems, potentially enabling lateral movement, data exfiltration, persistent backdoor installation, and denial of service. Organizations using Unizon for device management or control across their infrastructure face significant operational and security risk, particularly if the system manages critical hardware.

Affected systems

ATEN Unizon installations are affected. Verify the specific version scope against ATEN's official advisory. Unizon is commonly deployed for centralized management of ATEN devices such as KVMs, PDUs, and environmental controls in data centers and enterprise facilities.

Exploitability

Exploitation requires valid authentication credentials, which elevates the practical barrier compared to unauthenticated attacks. However, the attack chain is straightforward once authenticated: an attacker supplies a path containing directory traversal sequences (e.g., "../../") to the restoreDB method, and the lack of path validation allows the traversal to succeed. No user interaction is needed. An insider threat or credential compromise significantly increases risk. The vulnerability has not been assigned to the CISA Known Exploited Vulnerabilities (KEV) catalog as of the last update.

Remediation

Apply patches from ATEN as soon as they become available. Until patching is possible, restrict administrative access to ATEN Unizon to only trusted personnel, enforce strong authentication (consider multi-factor authentication if supported), disable remote access if operationally feasible, and monitor authentication logs for suspicious activity. Network segmentation can limit the blast radius if a compromise occurs.

Patch guidance

Consult ATEN's official security advisory for affected versions and corresponding patch releases. Apply patches to all Unizon instances in your environment. Verify patch deployment across all systems and confirm the restoreDB function no longer accepts unvalidated path traversal sequences. Test restoreDB functionality post-patching to ensure normal operations are not disrupted.

Detection guidance

Monitor ATEN Unizon audit logs for unusual restoreDB calls, particularly those containing path traversal patterns ("../", "..\\", encoded variants). Review file system access logs for unexpected file writes outside normal Unizon directories. Alert on failed authentication attempts followed by successful logins from the same source. If available, enable verbose logging on the restoreDB method and examine process execution logs for child processes spawned by the Unizon service with SYSTEM privileges.

Why prioritize this

Although authentication is required, SYSTEM-level code execution makes this a critical risk for any organization running Unizon. The combination of high impact and low attack complexity (once authenticated) justifies rapid remediation. Internal threats and credential compromise scenarios are common; assume that plausible access paths exist. Organizations should prioritize patching alongside credential hygiene reviews.

Risk score, explained

The CVSS 3.0 score of 7.2 reflects the severity of uncontrolled code execution at the system privilege level, balanced against the requirement for high-level authentication. The vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates network reachability, no special conditions needed post-authentication, and complete compromise of confidentiality, integrity, and availability. The score places this in the HIGH range, appropriate for a privileged insider threat or post-compromise lateral escalation scenario.

Frequently asked questions