Unitronics UniStream Pro CVE-2026-45450

Exploitation requires network reachability to the UniStream Pro controller (B10 or C10 hardware) running UniLogic firmware prior to 1.41.329, plus low-privilege authentication to the device (CVSS PR:L) - it is NOT remote-unauthenticated. The attacker must be able to deliver a crafted request that reaches the vulnerable buffer-handling code; the description does not name the exact protocol, service, or configuration feature involved, so the precise trigger is unconfirmed. Limiting factors: the required authentication, the need for network access to an OT device (normally segmented behind firewalls/VLANs), and the restriction to specific hardware variants (B10/C10) and firmware versions below 1.41.329. Devices already on 1.41.329 or later are not affected.

This is a high-severity (CVSS 8.3) memory-buffer flaw (CWE-119) in Unitronics UniStream Pro PLCs running UniLogic firmware prior to 1.41.329. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) indicates network-reachable, low-complexity exploitation requiring low-level authentication, with high confidentiality and integrity impact but only low availability impact - somewhat unusual for a buffer-bounds flaw in an OT device, where one would typically expect a crash/DoS (higher availability impact). No EPSS score, KEV listing, or POC indicator was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is moderated by the PR:L requirement (an attacker needs valid, if low-privilege, credentials or a foothold on the control network) and by the niche OT deployment context, but Unitronics PLCs have been targeted in prior ICS campaigns, so network-exposed or poorly-segmented devices should be treated as a genuine priority. Note a conflict worth verifying: the C:H/I:H against a PLC suggests the authenticated attacker can read/manipulate control logic or process data, yet A:L understates the operational-safety risk typical of memory corruption on a controller - verify the true availability/safety impact with Unitronics/INCD.

A low-privileged attacker who can reach the UniStream Pro controller over the network (e.g., from within an OT/engineering VLAN or via an exposed management interface) sends a crafted request that overruns a memory buffer in the UniLogic firmware, corrupting memory to disclose or alter controller data and logic. No public exploit code is known, and exploitation requires valid low-level authentication plus network reachability to the PLC, so it is not a drive-by remote-unauthenticated scenario.