Unitronics UniStream Pro/UniLogic: Memory buffer bounds restriction flaw
Summary
Unitronics UniStream Pro controllers (B10/C10 models) and the UniLogic programming software contain a memory buffer bounds flaw (CWE-119). Per the CNA record, an attacker with network access and low privileges could affect confidentiality, integrity and availability, with no user interaction required. The exact trigger and vulnerable component are not public. The CNA scores it 8.3 (CVSS 3.1), while VulDB rates it 6.3.
Affected
- UniStream Pro versions B10 / C10 (exact affected versions unknown)
- UniLogic versions prior to 1.41.329
Fixed in
- UniLogic 1.41.329 according to the CNA record
- The OpenCVE record states upgrade to 1.42.220 or above; the minimum fixed version is not yet confirmed by the vendor
- Vendor release notes list CVE-2026-45450 among the addressed issues
Workaround
- No workaround is documented where the patch is applied.
- Keep controllers and engineering PCs off the internet and behind firewalls in a segmented OT/IT zone.
- Disable unused services (web server, VNC, FTP) where possible.
- Restrict access to UniLogic project and remote-access functions.
Exploitation
- No known exploitation in the wild found.
- No public proof of concept found; VulDB states no exploit is available.
- CISA SSVC (as shown on OpenCVE): exploitation none, automatable no, technical impact total.
Our recommendation
- Identify all UniStream B10/C10 controllers and UniLogic installations and check their versions.
- Update UniLogic and UniStream to the newest release from Unitronics; confirm the minimum fixed version with the vendor first.
- Verify that no controller is reachable from the internet, via port forwarding, VPN misconfiguration or remote-access features.
- Isolate devices that cannot be patched promptly and monitor OT network traffic.
- Priority: high if internet-exposed or used in critical processes; medium if well segmented.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- gov.il CVE advisories listing www.gov.il
- Vulners CVE-2026-45450 (CVE list) vulners.com
- VulDB 420694 vuldb.com
- OpenCVE CVE-2026-45450 app.opencve.io
- ThreatINT CVE-2026-45450 cve.threatint.com
- UniLogic Release Notes (Unitronics) downloads.unitronicsplc.com
- UniLogic What's New (Unitronics help) www.unitronicsplc.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:43.
Original description (NVD)
: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.