EUVD-2026-102133
GHSA-6rgf-c89g-fcmq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege authenticated access
-
DeliverySubmit crafted input to vulnerable field
-
ExploitBreak out via OS command injection
-
ExecutionExecute arbitrary commands on device
-
ImpactCompromise PLC/HMI data and control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires low-privilege authenticated access (PR:L) to a Unitronics UniStream Pro device (B10/C10 versions) or the UniLogic interface running a version prior to 1.41.329; the attacker must reach an input field that is passed into an OS command. Exploitation is network-reachable (AV:N) with low complexity and no user interaction, but is limited by the need for valid credentials/authenticated access and by the device being deployed and network-exposed - typical of segmented OT/ICS networks, which constrains realistic reach. The exact vulnerable feature/parameter is not named in the available data. |
| Impact | This is a genuine but not top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity OS command injection requiring low-level authentication, with high confidentiality and integrity impact but only low availability impact - consistent with CWE-78 in an operator-facing PLC/HMI programming environment. No EPSS score, KEV listing, or public POC was provided, so by the precision rules the status is 'no public exploit identified at time of analysis'; there is no evidence of active exploitation. The PR:L requirement meaningfully lowers real-world risk versus an unauthenticated flaw, meaning an attacker must first obtain valid (even low-privilege) credentials or access to the device's authenticated interface. Note a signal tension worth verifying: command injection yielding arbitrary OS command execution typically implies high availability impact, yet the vendor-supplied vector sets A:L - this understates the plausible blast radius for a PLC and should be confirmed with Unitronics/INCD. The affected products are Unitronics UniStream Pro/UniLogic industrial control components, so impact is concentrated in OT/ICS environments rather than general IT. |
| Exploit ScenarioDerived | An attacker with low-privilege authenticated access to a Unitronics UniStream Pro (B10/C10) device or UniLogic management interface submits a crafted input into a field that is passed unsanitized to an OS command, causing arbitrary commands to run on the underlying system. Given AV:N/AC:L, this can be performed remotely over the network without user interaction once credentials are held. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
OS command injection in Unitronics UniLogic (versions prior to 1.41.329) and the UniStream Pro B10/C10 controllers it programs allows an authenticated low-privilege attacker who can reach a vulnerable input field to execute arbitrary operating-system commands on the affected device, resulting in full compromise of confidentiality and integrity plus partial availability impact. The flaw is network-reachable with low attack complexity and no user interaction, but requires valid credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), which limits practical exposure to devices whose programming or web interface is reachable from an untrusted network segment. No public exploit code or confirmed active exploitation was identified at time of analysis; the issue was reported by Israel's National Cyber Directorate (INCD).
RemediationAI
Upgrade UniLogic to version 1.41.329 or later, which is the first release outside the affected range, and update the firmware on any UniStream Pro B10/C10 controller that was commissioned with an affected UniLogic build; verify the installed UniLogic version from the About/Help dialog before and after the update. Where immediate upgrade is not possible, treat the UniStream Pro and any host running UniLogic as OT assets that must not be reachable from general IT or untrusted networks: place the controllers and engineering workstations behind a firewall or data diode, allow only the specific engineering protocols and ports required for programming, and block inbound access to any web or management interface from untrusted segments (trade-off: remote engineering and remote support workflows must move to a jump host or VPN). Disable or restrict accounts that do not require programming rights and remove default/weak credentials so that the PR:L precondition is harder to satisfy, and log and monitor for unexpected child processes or shell invocations originating from the engineering software or controller (trade-off: some control-system traffic may be proprietary and hard to inspect with generic IDS signatures). Consult the INCD advisory listing at https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0 and Unitronics' own support channels for the authoritative bulletin, since no vendor advisory URL was included in the provided references. Note that no public exploit code was identified at time of analysis, so this should be handled as a scheduled, risk-based remediation rather than an emergency patch action.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic OS command injection (CWE-78): user-supplied input is passed to a shell or system-level command without proper neutralization of special elements, so metacharacters embedded in the input are interpreted by the underlying operating system rather than treated as inert data. It affects Unitronics UniLogic, the Windows engineering/programming environment for UniStream Pro controllers, and by extension the UniStream Pro B10 and C10 hardware on which that logic runs; the CPE string only resolves to a generic vendor/product pair (cpe:2.3:a:unitronics:unitronics_unistream_pro/unilogic:*:*:*:*:*:*:*:*), so no CPE-level version granularity is available. Because the injection lands on the device/engineering-station OS, successful exploitation typically yields command execution in the context of the process handling the request, which can be leveraged for persistence, lateral movement within the OT network, or tampering with control logic. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U) indicates the vulnerable path is reachable over the network without user interaction but gated behind authentication, consistent with an engineering interface or management function rather than an anonymous pre-auth endpoint. The precise vulnerable parameter or feature is not named in the available data, and the assessed vector differs from the published one only in the availability metric (A:H vs. A:L), meaning the true availability impact may be higher than the vendor/CNA score suggests.
Know when Unitronics Unistream Pro Unilogic gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Network-reachable, low-complexity injection needing low-privilege auth (PR:L); arbitrary OS command execution justifies C:H/I:H and A:H, raising A above the vendor's A:L.
Primary rating from Vendor (INCD).
CVSS VectorVendor: INCD
DescriptionCVE.org
: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.
This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) - UniLogic versions prior to 1.41.329.
Executive ViewAI
Unitronics UniLogic (versions prior to 1.41.329) and UniStream Pro B10/C10 controllers are affected by a high-severity OS command injection flaw that an authenticated low-privilege attacker with network access could use to fully compromise confidentiality and integrity and partially affect availability. Because no vendor-released patch is currently identified and these are industrial control devices, leadership should prioritize reducing exposure of affected programming interfaces and controllers, especially where they are reachable from untrusted network segments. No public exploit code or confirmed active exploitation was identified at time of analysis.
No vendor-released patch identified at time of analysis; restrict network reachability of UniLogic programming and web interfaces and UniStream Pro B10/C10 controllers, enforce authenticated least-privilege access with MFA and VPN, disable unnecessary services, segment OT networks, monitor for command-injection activity, and apply vendor mitigations when published.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Improper authentication in Unitronics UniStream Pro B10/C10 controllers running UniLogic firmware prior to 1.41.329 allo
Authenticated low-privilege attackers can exploit a format string vulnerability in Unitronics UniStream Pro B10/C10 cont
Improper memory-buffer bounds handling in Unitronics UniStream Pro PLCs (B10 and C10 hardware variants) running UniLogic
Exploit-DB