CVE-2026-45450

Executive Summary

CVE-2026-45450 is a memory buffer bounds violation (CWE-119) affecting Unitronics UniStream Pro programmable logic controllers (B10 and C10) running UniLogic software versions prior to 1.41.329. The flaw carries a CVSS 3.1 base score of 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L), indicating that an authenticated network-reachable attacker can achieve high confidentiality and integrity impact with a only low-complexity attack. Because UniStream Pro devices operate in industrial control environments, successful exploitation can compromise process logic, HMI data, and downstream OT systems. No public PoC, Nuclei template, or KEV listing currently exists, and patch evidence remains absent (patch confidence 0/4).

Technical Analysis

The vulnerability is classified under CWE-119, "Improper Restriction of Operations within the Bounds of a Memory Buffer," and is publicly described by NVD as affecting "Unitronics UniStream Pro/UniLogic" with the affected range limited to UniStream Pro versions B10/C10 and UniLogic versions prior to 1.41.329.

CWE-119 is a parent category that encompasses a family of memory-safety defects including classic buffer overflows, out-of-bounds reads and writes, and insufficient bounds checking on memory copy or indexing operations. The defining property is that a software component performs an operation on a memory buffer without validating that the access remains within the buffer's allocated bounds. Based strictly on the supplied data, we know the impact characteristics from the CVSS vector:

• Confidentiality: High — memory from outside the intended buffer can likely be read and disclosed (e.g., leaking adjacent stack/heap contents).
• Integrity: High — out-of-bounds writes can likely corrupt in-memory structures, potentially altering control-flow-adjacent data or application state.
• Availability: Low — the flaw is not assessed as causing full denial of service, though a crash of the affected process is plausible.

The attack vector is Network (AV:N), meaning the vulnerable parsing/processing surface is reachable over the network. This is consistent with UniLogic's project upload/download, online-mode debugging, and PLC communication services, which expose network listeners used by engineering workstations. Privileges Required is Low (PR:L), meaning the attacker must hold some valid level of access (for example, a low-privileged session or a valid authentication to the affected network service). User Interaction is None (UI:N), so no victim action is required once the service is reachable. Scope is Unchanged (S:U), indicating the impact is confined to the vulnerable component's security authority.

The precise parsing routine, message format, and exact field that triggers the out-of-bounds condition are not disclosed in the NVD description or CNA title. No function names, endpoints, or parameters are provided. Accordingly, no code-level specifics should be inferred. The technical takeaway is that a network-reachable, authenticated input path into the UniLogic/UniStream Pro communication stack processes attacker-controlled data without adequate length validation, producing a buffer bounds violation.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-45450. The attack chain below is therefore described at the vulnerability-class level, consistent with the CWE-119 classification and the CVSS vector. No specific function names, protocol fields, or endpoints are fabricated because none are present in the source data.

1. Reconnaissance / Target Identification. An adversary enumerates industrial networks for Unitronics UniStream Pro B10/C10 devices. These controllers are typically exposed on OT VLANs or, in misconfigured deployments, directly reachable from IT/Internet segments. Fingerprinting can rely on the vendor's standard network listener ports and management interfaces. Because the attack vector is Network, the attacker only needs routable access to the relevant UniLogic service on the device or its engineering interface.

2. Privilege Positioning. The CVSS vector states PR:L, so the attacker is assumed to already possess a low-privileged credential or session — for example, a low-privilege account on the engineering workstation or a limited session accepted by the target service. Obtaining such access may come from credential reuse, weak/default credentials, or lateral movement within the OT network.

3. Triggering the Bounds Violation. With a valid low-privileged session, the attacker sends crafted input to the network-reachable parsing routine. Because this is a CWE-119 memory buffer bounds violation, the input is designed to exceed the expected length or index of a buffer that the vulnerable component does not validate. The specific message structure is unknown; the essential mechanism is that attacker-supplied data is copied or indexed into a fixed-size or insufficiently bounded buffer, resulting in an out-of-bounds read and/or write.

4. Post-Exploitation Impact. Per CVSS, the attacker can expect high confidentiality and high integrity impact with low availability impact. Practically, this could manifest as disclosure of memory contents (potentially including sensitive project data, credentials embedded in memory, or process state) and corruption of in-memory structures enabling manipulation of application behavior. In an ICS context, such manipulation could affect process logic, HMI data, or the integrity of the engineering project. A crash (low availability impact) is also possible depending on the memory region corrupted.

Because no exploit exists publicly, defenders should treat any anomalous, oversized, or malformed traffic toward the Unitronics services as a potential exploitation attempt and prioritize monitoring accordingly.

Impact Assessment

CVE-2026-45450 is rated CVSS 3.1 base 8.3 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L.

• Attack Vector (N): Exploitable remotely across a network boundary, increasing exposure wherever UniStream Pro devices or UniLogic engineering services are reachable.
• Attack Complexity (L): No special conditions or race windows are indicated; exploitation is repeatable given valid low-privileged access.
• Privileges Required (L): A low-privileged foothold is sufficient — the attacker does not need administrative access.
• User Interaction (N): No operator action is required; exploitation can proceed autonomously once the service is reached.
• Scope (U): Impact remains within the vulnerable component, though in ICS contexts the affected component typically controls physical processes, so real-world blast radius can exceed the formal Scope assessment.
• Confidentiality (H) / Integrity (H): The most severe dimensions. Memory disclosure and in-memory corruption can expose sensitive data and enable tampering.
• Availability (L): Limited; a process or device crash is possible but not the primary impact.

Blast radius. Affected assets are Unitronics UniStream Pro B10/C10 controllers running UniLogic versions prior to 1.41.329. In industrial environments these devices commonly act as process controllers and HMI-adjacent systems. Compromise can therefore cascade to connected field devices, SCADA/HMI layers, and safety-relevant processes. The EPSS score is not yet assigned by FIRST.org, so no probabilistic exploitation likelihood can be cited; CISA KEV status is NO as of this writing.

Detection Guidance

Sigma Rule

title: Potential CVE-2026-45450 Unitronics UniLogic Memory Corruption Attempt
id: 8c2f1a44-7b91-4e2a-9f6d-20c5a7e1b3d9
status: experimental
description: Detects anomalous or oversized network payloads targeting Unitronics UniStream Pro / UniLogic services, consistent with a CWE-119 buffer bounds violation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-45450
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026.45450
logsource:
  category: network_connection
  product: windows
detection:
  selection_ports:
    - dst_port: 20256
    - dst_port: 20005
  selection_process:
    - Image|endswith:
        - '\UniLogic.exe'
        - '\UniLogicSuite.exe'
  filter_known:
    - SourceIp|startswith: '10.'
  condition: selection_ports and selection_process and not filter_known
falsepositives:
  - Legitimate UniLogic engineering sessions
  - Authorized PLC firmware/project uploads
level: high

YARA Rule

rule CVE_2026_45450_Unitronics_UniLogic_Buffer_Bounds
{
    meta:
        description = "Detects oversized/oversized-length markers and Unitronics UniLogic artifacts potentially indicative of CVE-2026-45450 exploitation"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-45450"
        date = "2026-01-01"
        cve = "CVE-2026-45450"

    strings:
        $u1 = "UniLogic" ascii wide nocase
        $u2 = "UniStream" ascii wide nocase
        $u3 = "Unitronics" ascii wide nocase
        $buf_marker = { 00 00 00 00 FF FF FF FF }

    condition:
        uint16(0) == 0x5A4D and
        any of ($u1, $u2, $u3) and
        #buf_marker > 0
}

Suricata IDS Rule

alert tcp any any -> any 20256 (msg:"CVE-2026-45450 Unitronics UniLogic Potential Buffer Bounds Violation Attempt"; flow:to_server,established; content:"|55 6E 69|"; depth:3; content:"UniLogic"; nocase; dsize:>1400; threshold:type limit, track by_src, count 5, seconds 60; reference:cve,2026-45450; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-45450; classtype:attempted-admin; sid:202645450; rev:1;)

alert tcp any any -> any 20005 (msg:"CVE-2026-45450 Unitronics UniStream Pro Oversized Payload Detected"; flow:to_server,established; dsize:>2048; threshold:type both, track by_src, count 3, seconds 30; reference:cve,2026-45450; classtype:attempted-admin; sid:202645451; rev:1;)

Elastic Detection

network where
  destination.port in (20256, 20005, 445, 502) and
  event.action == "connection_attempted" and
  network.bytes > 1400 and
  not source.ip : ("10.0.0.0/8", "192.168.0.0/16", "172.16.0.0/12")

Splunk SPL Query

index=network sourcetype=suricata OR sourcetype=pan:traffic
| search (dest_port=20256 OR dest_port=20005)
| where bytes_out > 1400
| stats count values(src_ip) as sources values(dest_ip) as targets by dest_port, signature
| where count > 5
| table dest_port, signature, count, sources, targets
| sort - count

Wazuh OSSEC Rule

<group name="unitronics,cve-2026-45450,ics,">
  <rule id="2026450" level="12">
    <decoded_as>json</decoded_as>
    <field name="dst_port">20256</field>
    <field name="data_length" type="pcre2">^([2-9]\d{3,}|\d{5,})$</field>
    <description>CVE-2026-45450: Oversized payload sent to Unitronics UniLogic service - potential memory buffer attack</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="2026451" level="10">
    <if_sid>2026450</if_sid>
    <field name="src_ip" negate="yes">^10\.|^192\.168\.|^172\.(1[6-9]|2[0-9]|3[01])\.</field>
    <description>CVE-2026-45450: External source attempting Unitronics buffer overflow exploitation</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, workaround, or patch source has been confirmed by any tracked feed. No OSV packages and no affected-version entries beyond the NVD textual range were provided.

1) Immediate mitigations

• Isolate affected UniStream Pro B10/C10 controllers and UniLogic engineering hosts on segmented OT VLANs; never expose them directly to IT or the Internet.
• Enforce strict firewall/ACL rules so only authorized engineering workstations can reach the relevant PLC/engineering service ports (do not rely on default permits).
• Apply the principle of least privilege: audit and reduce low-privileged accounts that could satisfy the PR:L exploitation precondition; enforce strong, unique credentials and remove defaults.
• Enable protocol-aware monitoring at OT network boundaries and alert on oversized or malformed payloads directed at Unitronics services.
• Take offline backups of UniLogic projects and PLC configurations so integrity corruption can be recovered from a known-good state.

2) Patch / upgrade steps

• Monitor the Unitronics security advisory channel and NVD CVE-2026-45450 page for an official fix.
• The NVD description references UniLogic versions prior to 1.41.329; treat 1.41.329 as the vendor target baseline and plan an upgrade to that or later once a validated release is published. Do not assume 1.41.329 is a confirmed security patch — patch confidence remains 0/4.
• Until a fix ships, do not expose affected devices; if the devices are business-critical, consider compensating controls only (segmentation, monitoring).
• Where practical, replace or decommission end-of-support UniStream Pro B10/C10 units in exposed roles.

3) Long-term hardening

• Adopt an ICS asset inventory and continuous vulnerability management process that covers OT firmware and engineering software.
• Implement network micro-segmentation between engineering workstations, controllers, and the broader corporate network.
• Enable memory-safety-relevant compiler/OS hardening where the vendor supports it, and require memory-safe development practices in procurement criteria.
• Establish a patch governance SLA for OT assets, and rehearse recovery of PLC logic from trusted backups.
• Continuously monitor the Unitronics advisory page and OT-CERT guidance for updated remediation.

References

• NVD — CVE-2026-45450: https://nvd.nist.gov/vuln/detail/CVE-2026-45450
• CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer: https://cwe.mitre.org/data/definitions/119.html
• CISA Known Exploited Vulnerabilities Catalog (check for future addition): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Unitronics security advisories / product security page (monitor for official fix for UniLogic 1.41.329): https://www.unitronicsplc.com/
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat actor campaign attribution and in-the-wild exploitation evidence: none available for CVE-2026-45450 as of this report. No PoC, exploit code, or Nuclei template is public, and the CVE is not listed in CISA KEV. EPSS has not yet been scored by FIRST.org. Defenders should not assume low risk solely from the absence of public exploitation; the network-reachable attack vector and high C/I impact warrant proactive segmentation and monitoring.