This vulnerability (CVE-2026-9777) in ATEN Unizon arises from improper limitation of a pathname to a restricted directory (CWE-22) in the restoreDB method. The flaw is due to insufficient validation of user-supplied paths before file operations, enabling authenticated remote attackers to perform path traversal and execute arbitrary code as SYSTEM. The CVSS 3.0 score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows an authenticated remote attacker to execute arbitrary code with SYSTEM privileges on affected ATEN Unizon installations, potentially leading to full system compromise including confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the restoreDB functionality to trusted users only and monitor for suspicious activity involving this feature.