CVE-2026-45449

8.3High

Published 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.3High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on confidentiality, integrity
Weakness: CWE-78

Impact

Authenticated network attackers can execute arbitrary OS commands with high privileges on affected controllers. They need valid low-privileged credentials and network access to the UniStream Pro device.

Root cause

Improper neutralization of special elements in user-supplied input allows OS command injection.

Affected systems

Unitronics UniStream Pro (B10 / C10) using UniLogic versions prior to 1.41.329

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Fix & remediation

Upgrade UniLogic to version 1.41.329 or later and re-flash the affected controllers. As an interim workaround, restrict network access to the controller management interface to trusted hosts only.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.

References

https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0

Source: nvd.nist.gov/vuln/detail/CVE-2026-45449