CVE-2026-45451: Unitronics UniStream Pro Auth Bypass Flaw

CVE-2026-45451 Overview

CVE-2026-45451 is an improper authentication vulnerability [CWE-287] affecting Unitronics UniStream Pro programmable logic controllers (PLCs) running the UniLogic runtime. The flaw impacts UniStream Pro models B10 and C10 running UniLogic versions prior to 1.41.329. An authenticated attacker with low privileges can leverage the weakness over the network to compromise device confidentiality and integrity, with limited impact to availability. Unitronics UniStream controllers are deployed in industrial automation environments, meaning exploitation can affect operational technology (OT) processes. The vulnerability was published to the NVD on 2026-10-15.

Critical Impact
An authenticated network attacker can bypass authentication controls on UniStream Pro PLCs, enabling unauthorized access to industrial controller logic, configuration, and runtime data.

Affected Products

Unitronics UniStream Pro B10 running UniLogic versions prior to 1.41.329
Unitronics UniStream Pro C10 running UniLogic versions prior to 1.41.329
UniLogic programming environment versions prior to 1.41.329

Discovery Timeline

2026-10-15 - CVE-2026-45451 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-45451

Vulnerability Analysis

CVE-2026-45451 is classified as Improper Authentication [CWE-287] in the Unitronics UniStream Pro PLC family running the UniLogic runtime. The vulnerability allows an attacker who already holds low-privilege credentials on the device to perform actions that should require stronger authentication. Because UniStream Pro controllers expose network services used for programming, monitoring, and runtime management, this weakness provides an entry point into the control logic executed by the PLC.

Exploitation yields high impact to confidentiality and integrity, with limited impact to availability. In an industrial setting, this translates to the ability to read sensitive project data and alter runtime values or logic without the authorization normally required.

The EPSS score at publication is 0.29%, placing the vulnerability in the lower exploitation-likelihood band, and no public proof-of-concept exploit or CISA KEV listing has been recorded at the time of writing.

Root Cause

The root cause is improper enforcement of authentication within the UniLogic runtime on UniStream Pro B10 and C10 controllers. The device accepts requests from a low-privileged session without re-validating whether the session is authorized for the specific sensitive operation. Unitronics addressed the defect in UniLogic 1.41.329.

Attack Vector

The attack vector is network-based with low attack complexity. The attacker must hold low-level credentials on the target UniStream Pro device but does not need user interaction. From that session, the attacker issues requests to privileged functions that the runtime fails to authenticate properly, resulting in unauthorized read and write access to controller resources.

No verified exploit code is publicly available. Refer to the Israeli Government CVE Advisories for vendor-coordinated technical details.

Detection Methods for CVE-2026-45451

Indicators of Compromise

Unexpected UniLogic project downloads, uploads, or configuration changes originating from low-privileged accounts on UniStream Pro B10 or C10 controllers.
Authentication sessions from unusual source addresses or outside maintenance windows targeting PLC management ports.
Unexplained changes to tag values, ladder logic, or runtime parameters without a corresponding engineering change record.

Detection Strategies

Baseline normal UniLogic engineering traffic and alert on deviations in session count, source IP, or command type.
Correlate PLC authentication logs with HMI and historian activity to identify operations performed without matching operator actions.
Deploy OT-aware network monitoring to inspect Unitronics proprietary protocol flows for privileged commands issued from low-privilege sessions.

Monitoring Recommendations

Forward PLC and engineering workstation logs to a centralized SIEM for correlation with network telemetry.
Monitor for firmware or UniLogic version mismatches that indicate controllers remain on vulnerable builds prior to 1.41.329.
Track account usage on UniStream Pro devices and alert on low-privileged accounts issuing configuration or logic changes.

How to Mitigate CVE-2026-45451

Immediate Actions Required

Inventory all Unitronics UniStream Pro B10 and C10 controllers and identify UniLogic runtime versions.
Upgrade affected controllers to UniLogic 1.41.329 or later as soon as change-control processes allow.
Restrict network reachability to PLC management interfaces using firewalls, VLAN segmentation, and jump hosts.
Rotate credentials on affected devices and remove unused low-privileged accounts.

Patch Information

Unitronics has resolved the vulnerability in UniLogic version 1.41.329. Operators of UniStream Pro B10 and C10 devices should plan an upgrade to this release or later. Consult the Israeli Government CVE Advisories for the coordinated advisory and vendor references.

Workarounds

Place UniStream Pro controllers behind a dedicated OT firewall and permit management traffic only from authorized engineering workstations.
Disable or remove unnecessary user accounts on the PLC and enforce strong, unique passwords for remaining accounts.
Require VPN or jump-host access for any remote engineering connections to UniLogic runtimes.
Continuously monitor PLC authentication and configuration-change events until patching is complete.

bash

# Example firewall allow-list restricting UniStream Pro management access
# Replace addresses with the engineering workstation and PLC subnets in use
iptables -A FORWARD -s 10.10.20.0/24 -d 10.50.0.0/24 -p tcp --dport 20256 -j ACCEPT
iptables -A FORWARD -d 10.50.0.0/24 -p tcp --dport 20256 -j DROP