Dashboard / CVE-2026-9776

CVE-2026-9776

HIGH
MEDIUM Priority: 0.14 BB Relevance: 75/100
Published: 2026-06-24 Modified: 2026-10-25 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: High
I: None
A: None

Description

ATEN Unizon writeFileToHttpServletResponse Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of ATEN Unizon. Authentication is not required to exploit this vulnerability. The specific flaw exists within the writeFileToHttpServletResponse method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-28505.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
aten unizon < 2.7.264

References & Advisories (2)

Bug Bounty Relevance

75 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

7.5 / 10.0 v3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS — Exploitation Probability

1.85%
Raw Score 0.018510
Percentile 79.1%
Date 2026-10-29

EPSS Trend

2026-10-29
0.01851
2026-10-28
0.01851

Intelligence Sources

nvd ref →

External Links