{"id":"CVE-2026-5057","state":"PUBLISHED","title":"ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability","description":"ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ATEN Unizon. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the RpcProvider class. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-29041.","publishedAt":"2026-07-29T19:10:50.040Z","updatedAt":"2026-07-29T19:40:52.379Z","severity":{"score":7.5,"label":"High","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"zdi"},"assigner":"zdi","products":["ATEN Unizon"],"affected":[{"vendor":"ATEN","product":"Unizon","defaultStatus":"unknown","versions":[{"version":"2.6.253.001","status":"affected"}]}],"references":["https://www.zerodayinitiative.com/advisories/ZDI-26-272/","https://www.aten.com/global/en/supportcenter/info/security-advisory/26/"],"weaknesses":["CWE-306"],"ingestedAt":"2026-10-29T20:12:32.778Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/5xxx/CVE-2026-5057.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-5057","state":"PUBLISHED","datePublished":"2026-07-29T19:10:50.040Z","dateUpdated":"2026-07-29T19:40:52.379Z","assignerShortName":"zdi","assignerOrgId":"99f1926a-a320-47d8-bbb5-42feb611262e","dateReserved":"2026-03-27T18:08:40.710Z"},"containers":{"cna":{"title":"ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability","descriptions":[{"lang":"en","value":"ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ATEN Unizon. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the RpcProvider class. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-29041."}],"affected":[{"vendor":"ATEN","product":"Unizon","defaultStatus":"unknown","versions":[{"version":"2.6.253.001","status":"affected"}]}],"references":[{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-272/","name":"ZDI-26-272","tags":["x_research-advisory"]},{"url":"https://www.aten.com/global/en/supportcenter/info/security-advisory/26/","name":"vendor-provided URL","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","cvssV3_0":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","lang":"en","description":"CWE-306: Missing Authentication for Critical Function","type":"CWE"}]}],"providerMetadata":{"shortName":"zdi","orgId":"99f1926a-a320-47d8-bbb5-42feb611262e","dateUpdated":"2026-07-29T19:10:50.040Z"},"dateAssigned":"2026-03-27T18:08:40.734Z","datePublic":"2026-04-15T21:33:25.744Z","source":{"lang":"en","value":"Bobby Gould (@bobbygould5) of TrendAI Zero Day Initiative"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-29T19:39:37.435566Z","id":"CVE-2026-5057","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-29T19:40:52.379Z"}}]}}}