Priority CRITICAL 100KEV
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02089 · Published 2023-12-05 · Fixed in 9.9.00 CWE-1188
Priority HIGH 82
Embedded malicious code vulnerability in Vision1210, in the build 5 of operating system version 4.3, which could allow a remote attacker to store base64-encoded malicious code in the device's data tables via the PCOM pro…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00915 · Published 2023-07-13 · No fix listed CWE-506
Priority MEDIUM 49
Stack-based buffer overflow in Unitronics VisiLogic OPLC IDE before 9.8.30 allows remote attackers to execute arbitrary code via a crafted filename field in a ZIP archive in a vlp file.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04499 · Published 2016-06-25 · No fix listed CWE-119
Priority MEDIUM 49
Heap-based buffer overflow in Unitronics VisiLogic OPLC IDE before 9.8.09 allows remote attackers to execute arbitrary code via a long vlp filename.
CVSS 3.0CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.04962 · Published 2016-01-09 · No fix listed CWE-119
Priority MEDIUM 44
Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-78: 'OS Command Injection' may allow RCE
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01731 · Published 2024-03-18 · Fixed in 1.35.227 CWE-78
Priority MEDIUM 44
Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-22: 'Path Traversal' may allow RCE
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00854 · Published 2024-03-18 · Fixed in 1.35.227 CWE-22
Priority MEDIUM 44
CWE-287: Improper Authentication may allow Authentication Bypass
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.00684 · Published 2024-03-18 · Fixed in 1.35.227 CWE-287
Priority MEDIUM 41
Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor may allow Taking Ownership Over Devices
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00711 · Published 2024-03-18 · Fixed in 1.35.227 CWE-200
Priority MEDIUM 40
: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.
CVSS 3.1HIGH 8.3· Network · Low privileges · No interaction · EPSS 0.00821 · Published 2026-10-15 · No fix listed CWE-78
Priority MEDIUM 40
Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-348: Use of Less Trusted Source may allow RCE
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00355 · Published 2024-03-18 · Fixed in 1.35.227 CWE-348
Priority MEDIUM 40
Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-22: 'Path Traversal' may allow RCE
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0081 · Published 2024-03-18 · Fixed in 1.35.227 CWE-22
Priority MEDIUM 40
Unitronics VisiLogic OPLC IDE before 9.8.02 allows remote attackers to execute unspecified code via unknown vectors.
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.04734 · Published 2015-11-13 · No fix listed CWE-94
Priority LOW 39
Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-23: Relative Path Traversal
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00794 · Published 2024-03-18 · Fixed in 1.35.227 CWE-23
Priority LOW 39
Unitronics Vision Standard line of controllers allow the Information Mode password to be retrieved without authentication.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00503 · Published 2024-04-19 · No fix listed CWE-257
Priority LOW 38
Use of Externally-Controlled format string vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.
CVSS 3.1HIGH 8.3· Network · Low privileges · No interaction · EPSS 0.00267 · Published 2026-10-15 · No fix listed CWE-134
Priority LOW 38
: Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.
CVSS 3.1HIGH 8.3· Network · Low privileges · No interaction · EPSS 0.0029 · Published 2026-10-15 · No fix listed CWE-287
Priority LOW 38
: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.
CVSS 3.1HIGH 8.3· Network · Low privileges · No interaction · EPSS 0.00267 · Published 2026-10-15 · No fix listed CWE-119
Priority LOW 35
Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-259: Use of Hard-coded Password may allow disclosing Sensitive Information Embedded inside Device's Firmware
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.00431 · Published 2024-03-18 · Fixed in 1.35.227 CWE-259
Priority LOW 33
Unitronics Vision PLC – CWE-703: Improper Check or Handling of Exceptional Conditions may allow denial of service
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00447 · Published 2024-07-21 · Fixed in Upgrade to v9.9.1 CWE-703
Priority LOW 33
Unitronics VisiLogic OPLC IDE before 9.8.02 does not properly restrict access to ActiveX controls, which allows remote attackers to have an unspecified impact via a crafted web site.
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.01553 · Published 2015-11-13 · No fix listed CWE-284
Priority LOW 29
Unitronics Vision PLC – CWE-676: Use of Potentially Dangerous Function may allow security feature bypass
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00441 · Published 2024-07-21 · Fixed in Upgrade to v9.9.1 CWE-676
THREATIST.IORead the docs