Unitronics UniStream Pro EUVD-2026-102139

Exploitation targets Unitronics UniStream Pro controllers specifically in the B10/C10 hardware variants running UniLogic firmware prior to 1.41.329 - other variants or patched firmware are not in scope. Per the CVSS vector (AV:N/PR:L), the attacker needs network reachability to the controller and a low-privilege authenticated context (some valid credential or low-level access), not a fully unauthenticated path; no user interaction is required (UI:N). The principal limiting factors are the requirement for that low-privilege foothold, the narrow affected-version/hardware scope, and typical OT segmentation that restricts network reachability to the device. Note the 'Authentication Bypass' tag/CWE-287 may imply a weaker auth requirement than PR:L suggests - confirm the exact precondition with the INCD/vendor advisory.

The vendor-provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L, base 8.3 High) describes a network-reachable, low-complexity flaw requiring low-level privileges (PR:L) and no user interaction, yielding high confidentiality and integrity impact with low availability impact. The CWE-287 (Improper Authentication) classification and the 'Authentication Bypass' tag are in mild tension with the PR:L metric: an authentication-bypass weakness often implies a pre-auth condition (PR:N), yet the vector states some privilege is required - this should be verified with the vendor/INCD advisory, as it materially changes whether an attacker needs any valid foothold. No EPSS score, KEV listing, or POC/exploit-code indicator is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. On balance this is a genuinely serious flaw in industrial control equipment (improper authentication on a PLC/HMI platform), but absent EPSS/KEV/POC signals its real-world exploitation likelihood is currently unquantified rather than demonstrated - priority should be driven by the criticality of the OT environments where UniStream is deployed rather than by confirmed exploitation.

An attacker with network access to a UniStream Pro (B10/C10) controller and a low-privilege foothold abuses the improper-authentication flaw to access or act upon functions that should require stronger authentication, reading sensitive configuration/process data and altering controller state. No public exploit code is identified at time of analysis, so this remains a plausible but unproven scenario based on the CVSS vector.