Executive brief
Pacom Unison Client, a security management platform used for integrated building and access control, contains a vulnerability that allows authorized users to run unauthorized commands. By creating or modifying report templates, a user can embed malicious scripts that execute on the underlying system. This could lead to a complete takeover of the server, potentially compromising physical security systems and sensitive operational data.
Technical details
A Remote Code Execution (RCE) vulnerability exists in Pacom Unison Client 5.13.1 due to improper neutralization of special elements used in OS commands (CWE-78) within the Report Templates feature. Authenticated users can navigate to the Report properties and select C# as the scripting language for a template. By injecting malicious C# code (e.g., using System.Diagnostics.Process.Start) into the Scripts tab, the code is executed on the host system when the report is previewed or generated. This allows an attacker with low-level authenticated access to achieve full system compromise. As of the advisory date, a proof-of-concept is publicly available.
Affected products
- Pacom Unison Client 5.13.1
Timeline
- 2025-11: disclosed: Vulnerability discovered by Derek Yeh
- 2026-02-11: advisory: CVE-2025-65480 published