Unitronics Unistream Pro Unilogic
Monthly
Authenticated low-privilege attackers can exploit a format string vulnerability in Unitronics UniStream Pro B10/C10 controllers running UniLogic firmware prior to 1.41.329, potentially leading to memory corruption, sensitive information disclosure, and code execution. The flaw (CWE-134) is network-reachable and requires valid credentials but no user interaction, with high impact on confidentiality and integrity. No public exploit has been identified at time of analysis.
Improper authentication in Unitronics UniStream Pro B10/C10 controllers running UniLogic firmware prior to 1.41.329 allows a network-positioned attacker with low-level privileges to bypass authentication, yielding high confidentiality and integrity impact with low availability impact (CVSS 8.3). The flaw requires a valid low-privilege authenticated foothold (PR:L per the CVSS vector) and network reachability to the controller, with no user interaction; OT segmentation limits exposure. No public exploit code or active exploitation (CISA KEV) is identified at time of analysis, though the 'Authentication Bypass' tag suggests the exact authentication precondition should be confirmed in the INCD advisory.
Improper memory-buffer bounds handling in Unitronics UniStream Pro PLCs (B10 and C10 hardware variants) running UniLogic firmware prior to 1.41.329 allows an attacker with network reachability and low-privilege authentication (CVSS PR:L) to corrupt memory and potentially achieve high confidentiality and integrity impact with limited availability impact (CVSS 8.3). Because these are OT/ICS controllers, successful exploitation could let an authenticated actor disrupt or manipulate the logic and data handled by the device rather than just crash it. The flaw was reported by Israel's INCD; no public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV, so exploitation is currently assessed as requiring deliberate, targeted access rather than opportunistic scanning. Devices already running UniLogic 1.41.329 or later are not affected.
OS command injection in Unitronics UniLogic (versions prior to 1.41.329) and the UniStream Pro B10/C10 controllers it programs allows an authenticated low-privilege attacker who can reach a vulnerable input field to execute arbitrary operating-system commands on the affected device, resulting in full compromise of confidentiality and integrity plus partial availability impact. The flaw is network-reachable with low attack complexity and no user interaction, but requires valid credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), which limits practical exposure to devices whose programming or web interface is reachable from an untrusted network segment. No public exploit code or confirmed active exploitation was identified at time of analysis; the issue was reported by Israel's National Cyber Directorate (INCD).
Authenticated low-privilege attackers can exploit a format string vulnerability in Unitronics UniStream Pro B10/C10 controllers running UniLogic firmware prior to 1.41.329, potentially leading to memory corruption, sensitive information disclosure, and code execution. The flaw (CWE-134) is network-reachable and requires valid credentials but no user interaction, with high impact on confidentiality and integrity. No public exploit has been identified at time of analysis.
Improper authentication in Unitronics UniStream Pro B10/C10 controllers running UniLogic firmware prior to 1.41.329 allows a network-positioned attacker with low-level privileges to bypass authentication, yielding high confidentiality and integrity impact with low availability impact (CVSS 8.3). The flaw requires a valid low-privilege authenticated foothold (PR:L per the CVSS vector) and network reachability to the controller, with no user interaction; OT segmentation limits exposure. No public exploit code or active exploitation (CISA KEV) is identified at time of analysis, though the 'Authentication Bypass' tag suggests the exact authentication precondition should be confirmed in the INCD advisory.
Improper memory-buffer bounds handling in Unitronics UniStream Pro PLCs (B10 and C10 hardware variants) running UniLogic firmware prior to 1.41.329 allows an attacker with network reachability and low-privilege authentication (CVSS PR:L) to corrupt memory and potentially achieve high confidentiality and integrity impact with limited availability impact (CVSS 8.3). Because these are OT/ICS controllers, successful exploitation could let an authenticated actor disrupt or manipulate the logic and data handled by the device rather than just crash it. The flaw was reported by Israel's INCD; no public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV, so exploitation is currently assessed as requiring deliberate, targeted access rather than opportunistic scanning. Devices already running UniLogic 1.41.329 or later are not affected.
OS command injection in Unitronics UniLogic (versions prior to 1.41.329) and the UniStream Pro B10/C10 controllers it programs allows an authenticated low-privilege attacker who can reach a vulnerable input field to execute arbitrary operating-system commands on the affected device, resulting in full compromise of confidentiality and integrity plus partial availability impact. The flaw is network-reachable with low attack complexity and no user interaction, but requires valid credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), which limits practical exposure to devices whose programming or web interface is reachable from an untrusted network segment. No public exploit code or confirmed active exploitation was identified at time of analysis; the issue was reported by Israel's National Cyber Directorate (INCD).