CVE-2026-9778

HighCVSS 7.2/10Last modified Jun 27, 2026

Description

ATEN Unizon ImportDeviceList Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability.

The specific flaw exists within the ImportDeviceList method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-28579.

Metrics

CVSS 3.0 7.2/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Jun 24, 2026
Last modified: Jun 27, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-977808.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-977818.8Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attac CVE-2026-977826.8Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.CVE-2026-977836.1Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized a CVE-2026-9778510.0Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.CVE-2026-977877.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Container Isolation FS Filter Driver CVE-2026-977887.5Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a networ CVE-2026-977897.5Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-97797.2ATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Execution Vulnerability. This vulnerability CVE-2026-977905.5Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an autho CVE-2026-977917.5In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. T CVE-2026-977927.8Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges lo