This vulnerability in ATEN Unizon arises from improper limitation of a pathname to a restricted directory (CWE-22) in the writeFileToHttpServletResponse method. The lack of proper validation on user-supplied paths enables remote attackers to perform directory traversal attacks, disclosing sensitive information on affected systems. Exploitation does not require authentication and impacts version 2.7.262.002. The CVSS 3.0 base score is 7.5, reflecting high severity due to network attack vector, no privileges required, no user interaction, and high confidentiality impact.

Successful exploitation allows remote attackers to disclose sensitive information with SYSTEM-level privileges without authentication. This can lead to exposure of critical data, potentially aiding further attacks or information leakage. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — no official fix or remediation level has been provided by the vendor. Users should monitor the vendor advisory for updates and apply any official patches once available. Until then, consider restricting network access to the affected service and implementing compensating controls to limit exposure.