CVE-2026-45450: Unitronics UniStream Buffer Overflow Flaw

CVE-2026-45450 Overview

CVE-2026-45450 is a memory buffer vulnerability affecting Unitronics UniStream Pro programmable logic controllers (PLCs) running UniLogic firmware. The flaw is classified as Improper Restriction of Operations within the Bounds of a Memory Buffer [CWE-119]. An authenticated remote attacker on the network can trigger the condition to compromise confidentiality, modify integrity, and partially disrupt availability of the device. Unitronics PLCs are deployed in industrial control system (ICS) and operational technology (OT) environments, where exploitation can affect physical processes.

Critical Impact
An authenticated network attacker can corrupt memory on UniStream Pro B10 and C10 controllers, leading to high confidentiality and integrity impact and potential disruption of industrial processes.

Affected Products

Unitronics UniStream Pro B10 (UniLogic versions prior to 1.41.329)
Unitronics UniStream Pro C10 (UniLogic versions prior to 1.41.329)
UniLogic programming environment versions prior to 1.41.329

Discovery Timeline

2026-10-15 - CVE-2026-45450 published to the National Vulnerability Database
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-45450

Vulnerability Analysis

The vulnerability stems from improper restriction of operations within the bounds of a memory buffer in the UniLogic runtime that powers UniStream Pro B10 and C10 controllers. Operations acting on buffer memory do not correctly validate size or offset parameters supplied over the network. An authenticated attacker can craft input that reads or writes memory outside the intended buffer region. Successful exploitation yields high confidentiality and integrity impact, with a lower impact on controller availability.

Unitronics UniStream Pro devices are deployed as industrial controllers in manufacturing, utilities, and process automation. Memory corruption in this class of device can translate directly into operational technology (OT) consequences, including altered control logic, falsified process data, or disruption of physical processes.

Root Cause

The root cause is classified under [CWE-119], Improper Restriction of Operations within the Bounds of a Memory Buffer. UniLogic firmware prior to 1.41.329 does not enforce buffer boundaries for one or more operations exposed over its network-facing interfaces. Attacker-controlled values flow into memory operations without adequate length or bounds checks.

Attack Vector

The attack vector is network-based with low complexity. The attacker must hold low-level privileges on the target, consistent with an authenticated session to the controller or its management interface. No user interaction is required, and the scope of impact is confined to the vulnerable component. The vulnerability requires network reachability to the Unitronics PLC, which in well-segmented OT environments should be limited to engineering workstations and historians.

No verified public proof-of-concept code is available for this issue. For technical details and advisory information, refer to the Israeli Government CVE Advisories.

Detection Methods for CVE-2026-45450

Indicators of Compromise

Unexpected restarts, watchdog resets, or faults on UniStream Pro B10 or C10 controllers
Anomalous write operations to PLC memory regions outside normal engineering activity
Authenticated sessions to UniLogic services originating from hosts other than approved engineering workstations
Firmware or project checksum mismatches reported by the UniLogic environment

Detection Strategies

Inventory UniStream Pro B10 and C10 devices and record UniLogic firmware versions to identify assets running versions prior to 1.41.329.
Deploy ICS-aware network monitoring to inspect Unitronics protocol traffic for malformed or oversized payloads directed at PLCs.
Correlate authentication events on UniLogic services with change-control records to detect unauthorized configuration or memory operations.

Monitoring Recommendations

Forward PLC and engineering workstation logs into a central analytics platform for continuous review of authentication and configuration events.
Alert on new or unusual network sessions reaching UniStream Pro controllers from outside the OT management VLAN.
Baseline normal UniLogic project download and online-edit activity, and alert on deviations such as off-hours changes or repeated failed operations.

How to Mitigate CVE-2026-45450

Immediate Actions Required

Upgrade UniLogic and UniStream Pro B10 and C10 firmware to version 1.41.329 or later.
Restrict network access to Unitronics PLCs so that only approved engineering workstations can reach controller management services.
Rotate credentials used to authenticate to UniLogic services, especially on devices that were exposed to untrusted networks.
Review PLC project files and runtime configuration for unauthorized modifications.

Patch Information

Unitronics addresses the vulnerability in UniLogic version 1.41.329. Operators of UniStream Pro B10 and C10 devices should plan a maintenance window to upgrade both the UniLogic engineering software and the controller firmware. Consult the Israeli Government CVE Advisories for the authoritative advisory covering this issue.

Workarounds

Place UniStream Pro controllers behind an industrial firewall or data diode and block all inbound traffic from enterprise or internet-facing networks.
Enforce multi-factor authentication and least privilege on engineering workstations that connect to UniLogic.
Disable or restrict any remote-access pathways, including VPNs and vendor-maintenance tunnels, that terminate inside the OT network when not in active use.

bash

# Configuration example: restrict access to Unitronics PLC management
# Replace values with your environment-specific addresses

# Allow only the engineering workstation subnet to reach the PLC
iptables -A FORWARD -s 10.20.30.0/24 -d 10.50.60.10 -p tcp --dport 20256 -j ACCEPT
iptables -A FORWARD -d 10.50.60.10 -p tcp --dport 20256 -j DROP

# Log drops for monitoring and alerting
iptables -A FORWARD -d 10.50.60.10 -j LOG --log-prefix "UNITRONICS_DENY: "