Unitronics UniStream Pro/UniLogic: OS command injection

Summary

Unitronics UniStream Pro controllers (B10/C10) and the UniLogic programming software before version 1.41.329 contain an OS command injection flaw (CWE-78). An attacker with network access and low-privilege credentials can inject operating system commands, which the CNA rates as high impact to confidentiality and integrity. The CVSS score of 8.3 comes from the CNA because NVD analysis is still pending.

Affected

• UniStream Pro versions B10 and C10
• UniLogic versions prior to 1.41.329
• Unknown: whether other UniStream models are affected

Fixed in

• UniLogic 1.41.329 or later (CNA and VulDB)
• Vendor release notes (UniLogic 1.43.369 with UniStream OS 1.43.261) also list this CVE and recommend the update for B10/C10 controllers
• Confirm the minimum fixed version directly with Unitronics, as the release note dates are unclear

Workaround

• Unknown: no CVE-specific workaround confirmed
• Keep PLCs off the internet and restrict access to defined addresses or via VPN or ZTNA
• Change default passwords and use long, complex passwords

Exploitation

• Not listed in CISA's Known Exploited Vulnerabilities catalogue
• No public proof of concept or exploitation reports found for this CVE
• CISA SSVC assessment: exploitation none, automatable no, technical impact total
• Background: Unitronics PLCs have been actively exploited, but through default passwords and internet exposure, not through this CVE

Our recommendation

• Identify all UniStream and UniLogic installations and record firmware and software versions
• Remove any direct internet exposure of controllers and restrict access to trusted networks or VPN
• Update UniLogic and UniStream to 1.41.329 or later, preferably the build recommended by Unitronics
• Change default passwords and review accounts with access to the controllers
• Monitor controller access and network traffic for unusual activity
• Treat any internet-exposed controller as urgent

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• gov.il CVE advisories listing www.gov.il
• VulDB CVE-2026-45449 vuldb.com
• Unitronics UniLogic release notes downloads.unitronicsplc.com
• Unitronics UniLogic What's New www.unitronicsplc.com
• Strix CVE-2026-45449 www.strix.ai
• OpenCVE CVE-2026-45449 app.opencve.io
• CISA advisory AA26-097A www.cisa.gov
• Water-ISAC Unitronics UniStream update advisory www.waterisac.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:44.