CVE-2026-45449

Executive Summary

CVE-2026-45449 is an OS Command Injection vulnerability (CWE-78) in Unitronics UniStream Pro (B10 / C10) programmable logic controllers running UniLogic versions prior to 1.41.329. A network-reachable attacker with low-privilege authenticated access can inject and execute arbitrary operating-system commands, leading to full compromise of confidentiality and integrity and a partial availability impact, as reflected in the CVSS base score of 8.3. Because these devices sit at the OT/ICS edge and are frequently internet-exposed for remote engineering and HMI access, successful exploitation can grant an adversary a foothold inside industrial control networks.

Technical Analysis

The vulnerability class is OS Command Injection (CWE-78), defined as the failure to neutralize special elements (shell metacharacters, command separators, redirection operators, or substitution syntax) when constructing an operating-system command. In the context of this CVE, the NVD description states the flaw exists in the Unitronics UniStream Pro/UniLogic product line, with affected UniLogic versions prior to 1.41.329.

The CVSS vector provides the most reliable technical signal available:

• AV:N — the vulnerable component is reachable over the network. For a PLC/engineering environment, this typically means the UniLogic/UniStream management or engineering interface is accessible via TCP/IP, potentially including internet-facing deployments.
• AC:L — no unusual access conditions are required; a straightforward request pipeline can reach the vulnerable path.
• PR:L — the attacker requires low privileges, i.e., at least an authenticated or limited-trust session. This distinguishes the CVE from unauthenticated RCE and constrains the attack preconditions.
• UI:N — no user interaction is required; exploitation does not depend on a victim operator clicking a link or confirming a dialog.
• S:U — the impact is confined to the security scope of the vulnerable component (the controller/engineering stack), not an authority change across separate security scopes.
• C:H / I:H — full loss of confidentiality and integrity: the attacker can read and modify data on the affected device.
• A:L — partial availability impact, consistent with an attacker able to disrupt but not fully destroy the operational capability of the target.

What is explicitly NOT supported by the provided data: the specific parameter, endpoint, function name, or command-construction routine that carries the injection. The NVD description contains no additional detail on the injection vector (e.g., whether it is a web request field, a configuration import, or an HMI operation). Any enumeration of specific parameters, APIs, or internal source symbols would be speculation and is therefore omitted.

Mechanically, OS command injection arises when application logic concatenates untrusted input into a command string that is then handed to a shell or process-spawning API. Effective metacharacters typically include the command separators, piping operators, and substitution constructs of the underlying OS shell. Because a PLC engineering stack commonly invokes host operating-system utilities (for file handling, network configuration, diagnostics, or service control), an attacker who can influence the string that reaches that invocation can append or embed their own commands.

The attack surface is the UniStream Pro B10 / C10 management and engineering path that accepts operator- or automation-supplied input and maps it to host-level operations. This class of input includes any interface that ultimately shells out: service/daemon configuration, project or recipe upload handling, firmware/diagnostic routines, or network diagnostics. However, without confirmed technical detail, the report treats the exact ingress point as unspecified and reasons at the vulnerability-class level.

Affected scope is strictly delineated by the description: Unitronics UniStream Pro versions "only (B10 / C10)" operating UniLogic versions prior to 1.41.329. Other UniStream models and UniLogic builds at or above 1.41.329 are not confirmed affected by the provided data.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template exists for CVE-2026-45449. The attack chain below is therefore inferred from the vulnerability class (CWE-78) and the CVSS vector, and is deliberately described without fabricating endpoint names, parameters, or function symbols.

1. Reconnaissance and target identification. The attacker identifies Unitronics UniStream Pro / UniLogic devices exposed on the network. Because AV:N applies and industrial equipment is frequently internet-facing for remote support, discovery may be conducted through internet-wide scanning engines, Shodan-style device-fingerprint queries, or direct network scanning of OT VLANs. The attacker confirms the device and, where possible, the UniLogic version to determine whether it falls below 1.41.329.

2. Precondition establishment (low privilege). The PR:L rating means the attacker must first obtain a low-privileged session or otherwise reach an input path that accepts attacker-controlled data. This could be a legitimately provisioned account, a default or weak credential, or any authenticated role with limited trust. UI:N means no operator needs to be tricked into an action for the injection to fire; the request can be sent directly.

3. Triggering the flaw. The attacker submits crafted input to a field or interface that the device processes by constructing and executing an OS command. By embedding shell metacharacters (command separators, pipe operators, or substitution constructs of the underlying OS), the attacker causes the device to execute additional commands beyond those the developer intended. The command executes with the privileges of the vulnerable process on the UniStream Pro host — not the privileges of the low-privileged session, which is why PR:L still yields C:H/I:H impact (a privilege-scope/impact mismatch common to this class).

4. Post-exploitation impact. Successful injection yields arbitrary OS command execution on the controller/engineering host. Consequences track the CVSS subscores: full confidentiality loss (exfiltration of project files, configuration, credentials, and network topology), full integrity loss (modification of control logic, setpoints, or device configuration), and partial availability impact (disruption of the device or its services). In an OT context, a foothold on a PLC or its engineering workstation can be leveraged to pivot deeper into the industrial network.

Because no exploit-in-the-wild evidence or PoC is available, this scenario represents the plausible maximum impact given the vector, not an observed campaign.

Impact Assessment

The CVSS 3.1 base score is 8.3 (High). Attack vector is network (AV:N); complexity is low (AC:L); privileges required are low (PR:L); no user interaction (UI:N); scope is unchanged (S:U). The impact subscores are High for confidentiality (C:H) and integrity (C:I) and Low for availability (A:L). The absence of a scope change means the attacker's impact is modeled as confined to the vulnerable controller/engineering component rather than escalating to a separate security authority within the vulnerable system's boundary.

Business impact is determined by where these devices sit. Unitronics UniStream Pro B10 / C10 controllers are deployed in industrial and building-automation settings. Compromise of confidentiality and integrity means an adversary can read and alter process logic and configuration; partial availability impact means the target's operations can be degraded or intermittently disrupted. In safety-relevant processes this class of compromise carries physical-process consequences, though the provided data does not permit claims about specific affected deployments.

Blast radius: the primary target is the affected controller/engineering host. Because the same engineering environment commonly manages multiple endpoints and holds credentials and network detail, a successful attacker can use the compromised device as a pivot point into the wider control network. There is no evidence in the data that exploitation propagates automatically between devices.

EPSS is not yet scored by FIRST.org, so no probabilistic exploitation-likelihood figure can be cited. CISA KEV status is NO, meaning there is no confirmed evidence of active exploitation as of this writing.

Detection Guidance

Sigma Rule

title: Potential OS Command Injection Against Unitronics UniStream Pro / UniLogic
id: 5c9f1a2b-4544-9cve-8e01-a1b2c3d4e5f6
status: experimental
description: Detects process creation where a web/engineering service on a Unitronics UniStream Pro host (UniLogic prior to 1.41.329) spawns a shell or common OS utilities with metacharacter-laden arguments indicative of CWE-78 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-45449
author: Valters IT Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.78
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\UniLogic.exe'
      - '\UniStream.exe'
  selection_shells:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\sh'
      - '\bash'
  selection_meta:
    CommandLine|contains:
      - '&&'
      - '||'
      - ';'
      - '|'
      - '`'
      - '$('
      - '%ComSpec%'
  condition: selection_parent and selection_shells and selection_meta
falsepositives:
  - Legitimate maintenance scripts launched by engineering staff from the UniLogic host
level: high

YARA Rule

rule CVE_2026_45449_Unitronics_OSCommandInjection_Artifacts
{
    meta:
        description = "Detects shell-metacharacter payload patterns consistent with OS command injection (CWE-78) targeting Unitronics UniStream Pro / UniLogic prior to 1.41.329"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-45449"
        date = "2026-01-01"
        severity = "high"

    strings:
        $cwe78 = "CWE-78" ascii nocase
        $prod1 = "UniLogic" ascii nocase
        $prod2 = "UniStream" ascii nocase

        // Generic OS command-injection metacharacter payload fragments
        $inj1 = "&&" ascii
        $inj2 = "||" ascii
        $inj3 = "$(" ascii
        $inj4 = "`id`" ascii
        $inj5 = ";whoami" ascii nocase
        $inj6 = "|whoami" ascii nocase
        $inj7 = "/bin/sh" ascii
        $inj8 = "cmd.exe /c" ascii nocase
        $inj9 = "powershell -enc" ascii nocase

    condition:
        uint16(0) == 0x5A4D or
        (2 of ($inj*) and 1 of ($prod*)) or
        (any of ($inj*) and $cwe78)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-45449 Unitronics UniStream Pro / UniLogic OS Command Injection attempt (CWE-78)"; flow:established,to_server; http.method; content:"POST"; http.uri; pcre:"/(?:\%3B|;|\||%7C|&&|%26%26|\$\(|%24%28|`)(?:id|whoami|cat|cmd|sh|bash|powershell)/Ui"; reference:cve,2026-45449; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-45449; classtype:attempted-admin; sid:202645449; rev:1; metadata:affected_product Unitronics_UniStream_Pro, attack_target ICS_Controller, created_at 2026_01_01, cve CVE_2026_45449, signature_severity Major, tag cwe_78;)

Elastic Detection

process where event.type == "start" and
  process.parent.name : ("UniLogic.exe", "UniStream.exe") and
  process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "sh", "bash") and
  (
    process.command_line : "*&&*" or
    process.command_line : "*||*" or
    process.command_line : "*$(*" or
    process.command_line : "*`*" or
    process.command_line : "*;*"
  )

Splunk SPL Query

index=endpoint OR index=winlogbeat
sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="WinEventLog:Security"
(EventCode=1 OR EventCode=4688)
(Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\sh" OR Image="*\\bash")
(ParentImage="*\\UniLogic.exe" OR ParentImage="*\\UniStream.exe")
(CommandLine="*&&*" OR CommandLine="*||*" OR CommandLine="*$(*" OR CommandLine="*`*" OR CommandLine="*;*")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as cmdlines by ComputerName, User, ParentImage, Image
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="unitronics,cve_2026_45449,os_command_injection,">
  <rule id="202645449" level="12">
    <if_sid>60000</if_sid>
    <field name="win.eventdata.parentImage">UniLogic\.exe|UniStream\.exe</field>
    <field name="win.eventdata.image">cmd\.exe|powershell\.exe|pwsh\.exe|sh|bash</field>
    <field name="win.eventdata.commandLine">&&|\|\||\$\(|`|;</field>
    <description>CVE-2026-45449: Potential OS command injection spawned shell from Unitronics UniStream Pro / UniLogic host</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cwe_78,ics,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch, hotfix, vendor advisory, or fixed build has been verified from any tracked source. The NVD description references UniLogic versions prior to 1.41.329 as affected, which suggests 1.41.329 may be a relevant version boundary, but no patch confirmation is available and this must not be treated as a verified fix.

1. Immediate mitigations

• Remove direct internet exposure of UniStream Pro B10 / C10 controllers and UniLogic interfaces. Place them behind a firewall or VPN and enforce strict allow-lists for engineering access.
• Segment OT networks from IT and from untrusted networks; restrict reachability to the affected management/engineering path to a minimal set of trusted hosts.
• Enforce strong authentication and least privilege to reduce the feasibility of the PR:L precondition, and rotate any shared or default credentials.
• Monitor and alert on anomalous process spawns and shell metacharacters reaching the device; apply the detection rules in this report.
• Where feasible, disable or constrain non-essential services that shell out to the host OS.

2. Patch/upgrade steps

• No verified patch exists. Monitor Unitronics official channels and NVD for the release of a fixed UniLogic build at or above 1.41.329. Do not assume 1.41.329 resolves the issue until the vendor confirms it.
• Once a vendor fix is published, stage it in a non-production environment, validate control logic and process behavior, then roll out during a planned maintenance window with rollback capability.
• Maintain an inventory of UniStream Pro B10 / C10 devices and their UniLogic versions to prioritize upgrade order by exposure.

3. Long-term hardening

• Adopt a documented OT vulnerability and patch management program with defined SLAs for internet-exposed and safety-relevant assets.
• Enforce network segmentation with unidirectional gateways or data diodes where process integrity is critical.
• Require authenticated, encrypted, and audited engineering access (e.g., jump hosts with MFA).
• Continuously monitor for public exploit development and CISA KEV updates; reassess risk if EPSS scoring becomes available or if active exploitation is reported.

References

• NVD — CVE-2026-45449: https://nvd.nist.gov/vuln/detail/CVE-2026-45449
• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Unitronics — official product and security information (vendor channels should be monitored for a fix; no advisory is verified in this report): https://www.unitronicsplc.com/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-45449 NOT listed as of this writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-45449 in the data provided. No public PoC, exploit code, or Nuclei template is available.