Unitronics UniStream Pro/UniLogic: Improper authentication

Summary

Unitronics UniStream Pro (B10/C10) controllers and UniLogic programming software before 1.41.329 contain an improper authentication flaw (CWE-287). A network-reachable attacker with low privileges and no user interaction may be able to bypass identity verification and act on the controller. The CNA rates the severity as CVSS 8.3 (High); the exact conditions are not fully described in the sources, and the CVSS score is not yet confirmed.

Affected

• Unitronics UniStream Pro versions B10 and C10
• Unitronics UniLogic versions prior to 1.41.329 (per CNA record; the boundary at 1.41.329 is unconfirmed)

Fixed in

• Upgrade UniLogic and UniStream to version 1.42.220 or above (per CNA record)
• Exact fixed build for B10/C10 and UniLogic not yet confirmed with the vendor; sources conflict

Workaround

• Unknown. No CVE-specific workaround found.
• General measure: keep devices behind a firewall in a segregated OT network and do not expose them directly to the internet.

Exploitation

• No known exploitation of this CVE; not listed in CISA KEV.
• No public proof of concept found (VulDB states none exists; not independently verified).
• Unitronics devices have been attacked in the past, but no link to this CVE is confirmed.

Our recommendation

• Inventory all UniStream B10/C10 and UniLogic installations.
• Check whether any controller or engineering system is reachable from the internet or from office networks, and isolate it.
• Confirm the fixed build with Unitronics or the gov.il advisory, then schedule the update within a maintenance window.
• Monitor KEV and vendor channels for changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE record via OpenCVE app.opencve.io
• Israel National Cyber Directorate advisory listing www.gov.il
• Unitronics UniLogic release notes downloads.unitronicsplc.com
• VulDB entry vuldb.com
• Strix CVE entry www.strix.ai
• Water ISAC: UniStream PLC series update www.waterisac.org
• CISA advisory AA23-335A www.cisa.gov

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:43.