This vulnerability in ATEN Unizon 2.7.262.002 arises from insufficient validation of pathname inputs in the uploadSSL method, enabling authenticated remote attackers to perform arbitrary file deletion via directory traversal. The lack of proper path restriction allows manipulation of file operations beyond intended directories. The issue was tracked as ZDI-CAN-28503 and has a CVSS 3.0 base score of 5.5, reflecting medium severity with network attack vector, low attack complexity, and required high privileges but no user interaction.

An authenticated attacker can delete arbitrary files on the affected system, which may lead to denial-of-service conditions by removing critical files. There is no direct confidentiality impact, but integrity and availability are affected due to the ability to delete files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the uploadSSL functionality to trusted users only and monitor for suspicious activity related to file operations. Avoid exposing the vulnerable version publicly if possible.