CVE-2026-5057

VENDOR_NAME: ATEN AFFECTED_VERSION: Unknown MITRE_TACTIC: T1190 — Exploit Public-Facing Application SHODAN_DORKS: ["http.title:"ATEN Unizon"", "product:"ATEN Unizon RpcProvider"", "port:443 "Unizon""] CWE_ID: CWE-306 CVSS_VECTOR: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H POC_STATUS: None PATCH_DETAILS: No patch available

Executive Summary

CVE-2026-5057 is a missing authentication vulnerability in the RpcProvider class of ATEN Unizon that permits remote unauthenticated attackers to trigger a denial-of-service condition. Affected installations expose the RpcProvider functionality without requiring credentials, enabling any network-reachable attacker to disrupt service availability. The vulnerability carries a CVSS 7.5 High score with full impact on availability and no requirements for authentication or user interaction.

Technical Analysis

The flaw resides in the RpcProvider class within ATEN Unizon, where incoming RPC requests are processed without any preceding authentication checks. This stems directly from CWE-306 (Missing Authentication for Critical Function), allowing arbitrary callers to invoke methods that exhaust resources or crash the service. The attack surface is the network-exposed RPC endpoint, typically reachable over HTTP/HTTPS on standard management ports. Because no session validation, token verification, or access control is enforced before dispatching requests to resource-intensive handlers, an attacker can repeatedly submit crafted payloads that force excessive memory allocation, thread exhaustion, or unhandled exceptions leading to process termination. The absence of rate limiting or input sanitization on unauthenticated paths amplifies the impact to a reliable DoS vector.

Exploitation Scenarios

1. Reconnaissance begins with Shodan or Censys queries identifying exposed ATEN Unizon instances via the dorks above, followed by banner grabbing on port 443 or 80 to confirm the RpcProvider endpoint. 2) The attacker sends a series of unauthenticated POST or RPC calls directly to the /rpc or equivalent RpcProvider URI using tools such as curl or custom Python scripts, supplying minimal or malformed parameters that bypass any optional checks. 3) Payload execution consists of high-volume requests that invoke the vulnerable method paths, triggering internal resource consumption without authentication tokens. 4) Post-exploitation results in sustained service unavailability, with the process or host entering a DoS state until manual restart or timeout recovery occurs. (No public PoC exists.)

Impact Assessment

Organizations running ATEN Unizon for device management face complete loss of availability for the affected service, directly mapped to the CVSS A:H subscore. Blast radius is limited to the Unizon instance itself but can affect downstream managed devices if the management plane is taken offline. With CVSS 7.5 and EPSS at 0.00484, the vulnerability is technically exploitable by any remote attacker yet shows low observed exploitation rates. No confidentiality or integrity impact occurs.

Detection Guidance

Sigma Rule

title: ATEN Unizon RpcProvider Unauthenticated Requests
status: experimental
logsource:
  category: webserver
detection:
  selection:
    http.method: POST
    http.uri|contains: '/rpc'
    http.user_agent|contains: 'Unizon'
  filter:
    http.auth|exists: false
  condition: selection and not filter

YARA Rule

rule ATEN_Unizon_RpcProvider_DoS {
    strings:
        $rpc = "RpcProvider" ascii wide
        $unauth = "no authentication" ascii
    condition:
        $rpc and $unauth
}

Suricata IDS Rule

alert http any any -> any any (msg:"ATEN Unizon RpcProvider Missing Auth DoS Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/rpc"; threshold:type both, track by_src, count 50, seconds 10; classtype:denial-of-service; sid:20265057; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where destination.port in (80,443) and url.path like "*rpc*" and user.name == null] with runs=50

Splunk SPL Query

index=web_logs uri_path="*rpc*" method=POST NOT auth_token=* 
| stats count by src_ip 
| where count > 50 
| table src_ip count

Wazuh OSSEC Rule

<rule id="348224" level="10">
  <if_sid>31100</if_sid>
  <match>RpcProvider</match>
  <description>ATEN Unizon unauthenticated RPC access detected</description>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations include network segmentation to restrict access to Unizon management interfaces via IP allow-lists or VPN, and deployment of a reverse proxy with mandatory authentication enforcement in front of the RpcProvider endpoint. 2) Patch/upgrade steps are unavailable; monitor vendor advisories for future releases. 3) Long-term hardening requires enabling any available RPC authentication mechanisms, implementing strict input validation, and adding rate limiting on all unauthenticated endpoints.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-5057 https://www.zerodayinitiative.com/advisories/ZDI-26-5057/ https://cwe.mitre.org/data/definitions/306.html No known threat actor campaigns or in-the-wild exploitation evidence at time of reporting.