CVE-2026-9779

{
  "id": "CVE-2026-9779",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-24T22:16:50.590",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the updateWar method. The issue results from an incorrect implementation of cryptographic signature verification. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-28590."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de Ejecución Remota de Código por Verificación Incorrecta de Firma Criptográfica en ATEN Unizon doCryptoHugeFileToFile. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de ATEN Unizon. Se requiere autenticación para explotar esta vulnerabilidad.\n\nLa falla específica reside en el método updateWar. El problema se debe a una implementación incorrecta de la verificación de firma criptográfica. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto de SYSTEM. Fue ZDI-CAN-28590."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ATEN",
          "product": "Unizon",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "2.6.253.001",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV30": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.0",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-25T13:10:28.104178Z",
          "id": "CVE-2026-9779",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:aten:unizon:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2.7.264",
              "matchCriteriaId": "100AF252-A730-46A9-ADA3-A5DCF3C0C5EF"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.aten.com/global/en/supportcenter/info/security-advisory/32/",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-383/",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}