The vulnerability is an improper verification of a cryptographic signature within of ATEN Unizon. Because the signature check is incorrectly implemented, an attacker that can supply an update payload can cause the system to execute arbitrary code in the SYSTEM context. The flaw is specifically failure (CWE‑347). Authentication is required to execute the exploit, but once authenticated the attacker can gain full control.

The product affected is ATEN Unizon from vendor ATEN. No specific version information is provided in the advisory, so all installations of the Unizon product are potentially vulnerable until a patch is released.

The CVSS score of 7.2 classifies the vulnerability as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because authentication is required and the attack likely occurs through the updateWar routine, attackers need legitimate credentials to submit a malicious update payload. Once the signature is incorrectly validated, the payload runs with SYSTEM privileges, granting complete control over the affected installation.