Unitronics UniStream Pro / UniLogic (B10/C10): four High CVSS 8.3 flaws (OS command injection CVE-2026-45449, buffer, auth, format string) — upgrade UniLogic/UniStream to 1.41.329+ / 1.42.220+
Israel's National Cyber Directorate (INCD) published four CVE records on 15 October 2026 for Unitronics UniStream Pro (B10/C10) with UniLogic: CVE-2026-45449 (OS command injection, CWE-78), CVE-2026-45450 (memory-buffer restriction, CWE-119), CVE-2026-45451 (improper authentication, CWE-287) and CVE-2026-45452 (externally controlled format string, CWE-134). Each is rated CVSS 3.1 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) — network reachable with low privileges and no user interaction. Affected builds are UniStream Pro B10/C10 with UniLogic prior to 1.41.329. Solutions in the CVE records: upgrade UniLogic and UniStream to 1.41.329 or above for CVE-2026-45449, and to 1.42.220 or above for the other three. No exploitation is stated in the records. Unitronics PLCs have previously been targeted in OT incidents; treat internet-exposed HMI/PLC pairs as high priority. Primary: CVE/INCD records.
- Product
- Unitronics UniStream Pro (B10 / C10) with UniLogic programming environment
- Versions
- Affected: UniStream Pro B10/C10 with UniLogic prior to 1.41.329. Fixed: UniLogic/UniStream 1.41.329 or later (CVE-2026-45449); 1.42.220 or later (CVE-2026-45450, -45451, -45452).
- CVSS
- High (CVSS 3.1) for CVE-2026-45449, -45450, -45451 and -45452
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Exploited in Australia?
- unknown
- Patch to
- Upgrade UniLogic and UniStream Pro firmware/software to at least 1.41.329 (command-injection fix) and preferably 1.42.220+ for the full set. Remove UniStream management interfaces from the open internet; put them behind VPN or jump hosts with MFA; segment OT networks from IT.
Primary: CVE-2026-45449 — Unitronics UniStream Pro/UniLogic OS command injection (INCD, 15 Oct 2026) · Vendor: Israel National Cyber Directorate — CVE advisories listing · CVE: CVE-2026-45449, CVE-2026-45450, CVE-2026-45451, CVE-2026-45452 · Tenable — CVE-2026-45449 (and sibling 45450–45452)