Read the docs
TI-2026-74814 Aliases CVE-2026-45450

Memory buffer bounds flaw in Unitronics UniStream Pro and UniLogic

Priority LOW 38CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

Unitronics UniStream Pro (versions B10 / C10 only) and UniLogic (versions before 1.41.329) contain an improper restriction of operations within the bounds of a memory buffer (CWE-119). A remote attacker with low privileges and no user interaction can gain high confidentiality and integrity impact. The record gives no further attack details.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00267 18th percentileScored 2026-11-08
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnitronicsUnitronics UniStream Pro/UniLogicUnitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329—No fix listedCNA
  • Unitronics UniStream Pro/UniLogic VendorUnitronics Affected Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Unitronics UniStream Pro/UniLogic.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-45450

References

Other 1

  • TI-2023-05916 Unitronics VisiLogic uses a default administrative password KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-01885 Embedded malicious code vulnerability in Unitronics Vision1210 CVSS 3.1CRITICAL 9.8
  • TI-2016-03888 Stack-based buffer overflow in Unitronics VisiLogic OPLC IDE before 9.8.30 allows remote… CVSS 3.0CRITICAL 9.8
  • TI-2015-06605 Heap-based buffer overflow in Unitronics VisiLogic OPLC IDE before 9.8.09 allows remote… CVSS 3.0CRITICAL 9.6
  • TI-2024-18391 Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-78: 'OS Command Injection' CVSS 3.1HIGH 8.8
  • TI-2024-18387 Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-22: 'Path Traversal' CVSS 3.1CRITICAL 9.8
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences