CVE-2024-27772: Unitronics Unilogic RCE Vulnerability

CVE-2024-27772 Overview

CVE-2024-27772 is an OS command injection vulnerability [CWE-78] affecting Unitronics Unistream UniLogic versions prior to 1.35.227. The flaw allows an authenticated remote attacker to inject operating system commands into the UniLogic programming environment used to manage Unitronics programmable logic controllers (PLCs). Successful exploitation results in remote code execution on the affected system, with high impact to confidentiality, integrity, and availability. UniLogic is deployed in industrial control system (ICS) environments across manufacturing, water, and critical infrastructure sectors, making this vulnerability relevant to operational technology (OT) defenders.

Critical Impact
An authenticated attacker on the network can execute arbitrary operating system commands on hosts running Unitronics UniLogic prior to 1.35.227, leading to full compromise of the engineering workstation and downstream PLC operations.

Affected Products

Unitronics UniLogic versions prior to 1.35.227
Unitronics Unistream product line managed by vulnerable UniLogic versions
Engineering workstations running the UniLogic programming environment

Discovery Timeline

2024-03-18 - CVE-2024-27772 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-27772

Vulnerability Analysis

The vulnerability is classified as OS Command Injection under CWE-78. Unitronics UniLogic fails to properly neutralize user-controlled input before passing it to an operating system command interpreter. An attacker who supplies crafted input to an affected function can break out of the intended command context and execute arbitrary commands with the privileges of the UniLogic process.

Because UniLogic runs on engineering workstations that program and manage Unistream PLCs, code execution on that host gives an attacker a foothold to alter ladder logic, modify PLC configurations, or pivot deeper into the OT network. The attack requires network access and low-level authentication to the target, but does not require user interaction.

Root Cause

The root cause is missing or insufficient input sanitization on parameters that are eventually forwarded to a shell or OS command execution API. Special shell metacharacters such as ;, |, &, and backticks are not filtered or escaped, allowing an attacker to append additional commands to a legitimate operation. Refer to the Claroty Team82 research for the vendor-coordinated technical breakdown.

Attack Vector

The attack is delivered over the network against a UniLogic instance. The attacker must possess valid low-privilege credentials to reach the vulnerable function. Once authenticated, the attacker sends crafted input containing shell metacharacters and appended commands. The UniLogic process invokes the underlying OS shell, executing the injected payload alongside the intended command. No user interaction is required at the target.

See the Israeli Government CVE Advisories for the official coordinated disclosure notice.

Detection Methods for CVE-2024-27772

Indicators of Compromise

Unexpected child processes spawned by the UniLogic application, particularly command shells such as cmd.exe or powershell.exe
Outbound network connections from UniLogic engineering workstations to unfamiliar hosts
Unauthorized modifications to PLC project files, ladder logic, or configuration parameters
Log entries containing shell metacharacters (;, |, &, `, $()) in UniLogic request parameters

Detection Strategies

Monitor process creation events where UniLogic is the parent process and the child is a shell, scripting interpreter, or LOLBin
Deploy network intrusion detection signatures that flag command injection patterns targeting UniLogic services
Baseline normal UniLogic behavior on engineering workstations and alert on deviations in process, file, or network activity

Monitoring Recommendations

Enable verbose logging on UniLogic hosts and forward events to a centralized SIEM for correlation
Instrument OT network segments with passive monitoring to identify anomalous traffic between IT and engineering subnets
Track authentication events against UniLogic instances and alert on unusual source addresses or off-hours access

How to Mitigate CVE-2024-27772

Immediate Actions Required

Upgrade Unitronics UniLogic to version 1.35.227 or later on all engineering workstations
Inventory every host running UniLogic and confirm patch status before returning systems to production use
Restrict network access to UniLogic services using firewall rules that only permit trusted engineering hosts
Rotate credentials used to authenticate to UniLogic, especially any shared or default accounts

Patch Information

Unitronics addressed the vulnerability in UniLogic version 1.35.227. Administrators should download the fixed release from Unitronics and apply it to all affected engineering workstations. Consult the Claroty Team82 advisory and the Israeli Government CVE listing for coordinated disclosure details.

Workarounds

Segment OT networks from corporate IT and place UniLogic hosts behind a jump server with multi-factor authentication
Disable or firewall off remote access to UniLogic services if patching cannot be performed immediately
Apply the principle of least privilege to UniLogic accounts and remove unused users
Monitor for anomalous process and network activity on UniLogic workstations until patches are installed

bash

# Example firewall rule to restrict UniLogic access to a trusted engineering subnet
# Replace 10.10.20.0/24 with the actual engineering workstation subnet
iptables -A INPUT -p tcp --dport 20256 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 20256 -j DROP