Unitronics UniStream Pro/UniLogic: Format string vulnerability (CWE-134)
Summary
Unitronics UniStream Pro controllers (B10/C10) and the UniLogic configuration software prior to 1.41.329 contain an externally controlled format string vulnerability (CWE-134). According to the CVSS vector, an attacker with network access and a low-privilege account can impact confidentiality and integrity, and can affect availability to a lesser degree, without user interaction. Exposure beyond the OT network, for example through remote access or port forwarding, makes exploitation considerably more likely.
Affected
- UniStream Pro (B10 / C10): affected versions as stated by the CNA, exact range not confirmed
- UniLogic: versions prior to 1.41.329
- Unknown: UniStream OS firmware version for this CVE
Fixed in
- UniLogic 1.41.329 (CNA and VulDB data)
- The CNA solution field states UniLogic and UniStream upgrade to 1.42.220 or above; this conflicts with 1.41.329 and must be confirmed with Unitronics
- Vendor release notes from September 2026 (UniLogic 1.43.369 / UniStream OS 1.43.261) list CVE-2026-45452 as addressed
Workaround
Unknown. No vendor workaround or mitigation was found. The practical mitigation is to apply the vendor fix.
Exploitation
- Not listed in CISA KEV
- CISA SSVC: exploitation none, not automatable, total technical impact
- No exploitation in the wild and no public proof of concept found in the sources reviewed; search was limited
- EPSS is low (about 0.00267)
Our recommendation
- Inventory all UniStream Pro B10/C10 controllers and UniLogic installations
- Verify that no controller or UniLogic service is reachable from the internet and restrict access to the OT network
- Update UniLogic and UniStream to the vendor-confirmed fixed version, ideally the latest release
- Restrict access to controllers and engineering systems to trusted accounts and monitor for unusual logins
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Israel National Cyber Directorate (gov.il) CVE advisories listing www.gov.il
- VulDB CVE-2026-45452 vuldb.com
- Vulners CVE-2026-45452 vulners.com
- OpenCVE CVE-2026-45452 app.opencve.io
- Unitronics UniLogic release notes downloads.unitronicsplc.com
- Strix CVE-2026-45452 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:44.
Original description (NVD)
Use of Externally-Controlled format string vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.