ATEN Unizon suffers a directory traversal flaw within its restoreDB method that allows an authenticated attacker to supply a crafted file path. The missing validation permits file operations outside the intended directory, enabling the attacker to execute arbitrary code with SYSTEM privileges, thereby compromising confidentiality, integrity, and availability of the affected host.

The vulnerability affects ATEN Unizon installations. Version information is not disclosed in the advisory, so administrators should determine whether their deployment includes the restoreDB functionality and is running an older release that has not received the patch.

The CVSS score of 7.2 indicates a high severity, yet the EPSS data is unavailable, making exploitation frequency uncertain. The vulnerability is not listed in CISA KEV, implying no publicly known exploits yet. Because authentication is required, a potential attacker would first obtain legitimate credentials or compromise an existing account to gain access, after which the directory traversal can be leveraged to run code as SYSTEM, giving full control over the target system.