CVE-2026-45449
HighCVSS 8.3Summary
Unitronics UniStream Pro (B10/C10) with UniLogic before version 1.41.329 contains an improper neutralization of special elements used in an OS command (OS command injection) vulnerability. This may allow execution of arbitrary commands.
Risk Assessment
The vulnerability may allow an attacker to execute arbitrary system commands, leading to full compromise of the device and potentially the entire network.
Recommendation
Update UniLogic to version 1.41.329 or later. Restrict network access to Unitronics devices and enforce least privilege.
Other vulnerabilities in Unitronics UniStream Pro/UniLogic
See all- CVE-2026-45452High
Unitronics UniStream Pro (B10/C10) with UniLogic before version 1.41.329 contains a use of externally-controlled format string vulnerability. This may lead to unexpected behavior or code execution.
- CVE-2026-45451High
Unitronics UniStream Pro (B10/C10) with UniLogic before version 1.41.329 contains an improper authentication vulnerability. This may allow bypassing authentication mechanisms.
- CVE-2026-45450High
Unitronics UniStream Pro (B10/C10) with UniLogic before version 1.41.329 contains an improper restriction of operations within the bounds of a memory buffer vulnerability. This may lead to buffer overflow and code execution.
Original NVD description (English source)
: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS