ATEN eco DC fwDeletes.json Directory Traversal Arbitrary File Deletion Vulnerability

November 13th, 2026
ZDI-26-992 ZDI-CAN-28621

CVE ID

CVE-2026-126964

CVSS Score

5.5 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

Affected Vendors

ATEN

Affected Products

eco DC

Vulnerability Details

This vulnerability allows remote attackers to delete arbitrary files on affected installations of ATEN eco DC. Authentication is required to exploit this vulnerability.

The specific flaw exists within the handling of JSON request data supplied to the fwDeletes.json endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM.

Additional Details

Fixed in eco DC 1.2.119


Disclosure Timeline

  • 2026-08-04 - Vulnerability reported to vendor
  • 2026-11-13 - Coordinated public release of advisory
  • 2026-11-13 - Advisory Updated

Credit

Ahmed Y. Elmogy

Back to Advisories