This vulnerability in ATEN Unizon arises from improper limitation of a pathname to a restricted directory (CWE-22) in the writeFileToHttpServletResponse method. Due to lack of proper validation of user-supplied file paths, remote attackers can perform directory traversal attacks to access sensitive files. Exploitation does not require authentication and results in information disclosure under SYSTEM privileges. The CVSS 3.0 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Successful exploitation allows remote unauthenticated attackers to disclose sensitive information from the affected system with SYSTEM-level privileges. This can lead to exposure of confidential data, potentially compromising system security and privacy.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Users should monitor ATEN's advisories for updates and consider restricting network access to the affected service until a fix is available.