Unitronics UniStream Pro CVE-2026-45452

Exploitation requires authenticated access at a low privilege level (CVSS PR:L) to the network-reachable interface of Unitronics UniStream Pro Pro-line controllers (hardware variants B10/C10) running UniLogic firmware prior to 1.41.329; the attacker must be able to supply input that reaches a function interpreting it as a format string (CWE-134). Limiting factors: valid credentials are mandatory (not unauthenticated), the vulnerability is specific to the Pro B10/C10 models and pre-1.41.329 UniLogic versions, and no user interaction is needed once authenticated. Devices updated to UniLogic 1.41.329 or later, or non-Pro UniStream variants, are outside the stated affected scope.

This is a genuine but conditional priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L, base 8.3 High) indicates a network-reachable, low-complexity flaw requiring authentication (PR:L) with no user interaction, yielding high confidentiality and integrity impact and low availability impact - consistent with a CWE-134 externally-controlled format string that can leak process memory (%x/%s) and corrupt it (%n). No EPSS score was supplied, the CVE is NOT in CISA KEV, and no public POC is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. No SSVC decision data was provided. The key tension is that the PR:L requirement meaningfully limits real-world risk: an attacker must already hold valid low-privileged credentials on the UniStream Pro/UniLogic device, so this is not drive-by unauthenticated RCE. Note also that the C:H/I:H rating implies more than mere information disclosure, yet the vendor Tags label this only as 'Information Disclosure' - verify with INCD/vendor whether memory-write (%n) consequences such as code execution or integrity corruption are in scope, as the tag appears to understate impact.

An attacker with valid low-privileged access to a Unitronics UniStream Pro (B10/C10) device supplies attacker-controlled input that is passed unsanitized into a format-string-processing function. By embedding format specifiers (e.g. %x, %s, %n), the attacker reads adjacent process memory to disclose sensitive data and can corrupt memory to affect integrity. No public exploit code is referenced, so exploitation would currently require custom tooling against the authenticated interface.