CVE-2024-27768: Unitronics Unilogic RCE Vulnerability

CVE-2024-27768 Overview

CVE-2024-27768 is a path traversal vulnerability [CWE-22] affecting Unitronics Unistream UniLogic versions prior to 1.35.227. The flaw allows network-based attackers to traverse directories outside the intended scope, potentially leading to remote code execution (RCE) on affected programmable logic controller (PLC) programming environments. Unitronics UniLogic is used to program Unistream industrial controllers deployed across manufacturing, water treatment, and critical infrastructure environments. The vulnerability requires no authentication or user interaction and impacts confidentiality, integrity, and availability.

Critical Impact
Unauthenticated attackers can traverse file system paths and execute arbitrary code on systems running vulnerable UniLogic versions, enabling full compromise of industrial control system tooling.

Affected Products

Unitronics UniLogic versions prior to 1.35.227
Unitronics Unistream programmable logic controllers programmed via vulnerable UniLogic builds
Industrial environments using UniLogic as the engineering workstation software

Discovery Timeline

2024-03-18 - CVE-2024-27768 published to NVD
2025-03-10 - Last updated in NVD database

Technical Details for CVE-2024-27768

Vulnerability Analysis

The vulnerability stems from improper sanitization of file path inputs within the UniLogic application. Attackers can supply crafted path sequences containing traversal characters such as ../ to escape the intended working directory. Once outside the restricted directory, attackers can read, write, or place files in arbitrary filesystem locations.

In industrial control system (ICS) software, path traversal commonly escalates into remote code execution. Writing to sensitive locations such as startup directories, plugin folders, or configuration paths lets attackers stage payloads that execute under the privileges of the UniLogic process. The advisory from Claroty's Team82 details the broader research into Unistream weaknesses and confirms the path traversal class.

Root Cause

The root cause is the absence of canonical path validation when handling user-supplied file or resource names. The application accepts relative paths without normalizing them or verifying that the resolved path remains within an allowed base directory. This is a classic [CWE-22] failure pattern.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker reaches the vulnerable component over the network and submits requests containing traversal sequences. By chaining file write primitives with a known executable path, the attacker achieves arbitrary code execution on the host running UniLogic. See the Claroty Team82 research on Unitronics Unistream for technical context.

Detection Methods for CVE-2024-27768

Indicators of Compromise

Network requests to UniLogic services containing ../, ..\, or URL-encoded equivalents such as %2e%2e%2f
Unexpected file creation or modification in UniLogic installation directories or system startup paths
New or modified executables, DLLs, or scripts in directories writable by the UniLogic process
Outbound connections from engineering workstations running UniLogic to unfamiliar external hosts

Detection Strategies

Inspect application and web server logs from UniLogic for path components containing traversal sequences
Monitor process creation chains where UniLogic spawns shells, scripting interpreters, or unfamiliar binaries
Deploy network monitoring on operational technology (OT) segments to identify anomalous file transfer operations targeting engineering workstations
Compare installed UniLogic versions across the fleet against the patched baseline of 1.35.227

Monitoring Recommendations

Enable file integrity monitoring on UniLogic installation paths and PLC project directories
Forward endpoint telemetry from engineering workstations into a centralized analytics platform for correlation
Alert on unauthenticated connection attempts to UniLogic service ports from non-engineering subnets

How to Mitigate CVE-2024-27768

Immediate Actions Required

Upgrade Unitronics UniLogic to version 1.35.227 or later on all engineering workstations
Inventory all Unistream PLCs and the UniLogic versions used to program them
Restrict network access to UniLogic engineering workstations using firewall rules that allow only authorized OT management hosts
Isolate ICS networks from corporate IT networks following IEC 62443 zone and conduit guidance

Patch Information

Unitronics has released UniLogic version 1.35.227 to address the path traversal vulnerability. Customers should obtain the patched release from Unitronics support channels and apply it to every workstation running UniLogic. Review the Claroty Team82 advisory and the Israeli Government CVE Advisories Listing for vendor-coordinated guidance.

Workarounds

Place UniLogic workstations behind a jump host requiring multi-factor authentication
Block inbound network access to UniLogic service ports from untrusted networks at the perimeter and within OT segments
Disable or uninstall UniLogic on hosts that do not actively program Unistream PLCs
Apply application allowlisting to prevent execution of unauthorized binaries dropped through traversal writes

bash

# Configuration example: restrict access to UniLogic engineering workstation
# Replace 10.10.20.0/24 with your authorized engineering subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP