CVE-2026-45451

Executive Summary

CVE-2026-45451 is an improper authentication vulnerability (CWE-287) affecting Unitronics UniStream Pro B10 and C10 programmable logic controllers (PLCs) when used with UniLogic software versions prior to 1.41.329. The flaw carries a CVSS 3.1 base score of 8.3 (High), reflecting network reachability with low attack complexity and high impact to confidentiality and integrity. Successful exploitation could allow an authenticated or weakly-authenticated remote actor to bypass intended authentication controls on industrial control equipment, exposing operational technology (OT) environments to unauthorized command, configuration, or process manipulation.

Technical Analysis

The vulnerability is classified under CWE-287 (Improper Authentication). Per the NVD description, the affected products are "Unitronics UniStream Pro/UniLogic," specifically "Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329." The nature of the flaw is that authentication for a protected function or interface is not enforced correctly, allowing a remote actor to reach functionality that should require validated credentials.

UniStream Pro B10/C10 are integrated PLC/HMI (human-machine interface) controllers used in industrial automation. UniLogic is the engineering environment and runtime programming suite used to author, deploy, and communicate with these controllers. The coupling of an engineering toolchain with a live controller runtime creates a broad attack surface: project download/upload, runtime configuration, tag/data access, and HMI interactions.

The CVSS temporal/environmental-neutral subscores are informative and constrain the technical interpretation:

• AV:N (Network) — the vulnerable interface is reachable over the network rather than requiring physical or adjacent access. On UniStream Pro this corresponds to network-exposed services (Ethernet/industrial protocol interfaces), not a local-only debug channel.
• AC:L (Low) — no special preconditions, race windows, or conditions beyond attacker control are required for a successful attempt.
• PR:L (Low) — the vector requires some level of authenticated or otherwise privileged context. This is a critical nuance: the flaw is not fully unauthenticated in the CVSS sense. The "improper authentication" is most consistent with either (a) authentication that can be satisfied trivially or bypassed with minimal/weak credentials, or (b) a logic error that permits a low-privileged session to reach higher-privileged functionality. Which of these applies is not specified in the available data; no function, endpoint, file path, or parameter is disclosed.
• UI:N (None) — no user interaction is required; the attack is automated/direct.
• S:U (Unchanged) — the impact is scoped to the vulnerable component; exploitation does not, per the vector, cross into other security authorities.
• C:H / I:H — high confidentiality and integrity impact. The controller's configuration, project logic, tag data, and secrets could be read (C:H) and modified (I:H) — the latter is especially severe for a PLC controlling physical processes.
• A:L (Low) — some availability degradation is anticipated but not total; consistent with a partial loss of function rather than a guaranteed denial-of-service.

Because the vulnerability class is improper authentication and the description is sparse, no specific implementation detail (authentication token handling, session establishment, or credential verification routine) can be asserted. The defensible characterization is: an attacker with network access and a low-privilege foothold or weak credential can bypass or satisfy authentication to reach functionality that should be denied, then read and alter controller data.

Exploitation Scenarios

No public PoC or exploit code exists for CVE-2026-45451. The following chain is inferred strictly from the vulnerability class (CWE-287) and the CVSS vector; no implementation-specific function, endpoint, or parameter is asserted because none is disclosed.

1. Reconnaissance / target identification. An adversary maps internet- or plant-network-accessible Unitronics UniStream Pro B10/C10 endpoints, for example via Shodan/Censys queries for Unitronics-related banners (product:"Unitronics", http.html indicators, or industrial protocol port probes such as Modbus/TCP 502 where exposed). UniStream Pro devices are often deployed on flat OT networks and increasingly reachable from IT or remote-access paths.

2. Authentication surface identification. The attacker probes the network-exposed management/runtime interface on the controller. Because the vector is AV:N/PR:L, the attacker is expected to either already possess a minimal credential/role or be able to obtain/satisfy one trivially. The improper-authentication defect is then triggered by presenting a request that the target fails to properly validate before granting access to a protected function.

3. Triggering the flaw (vulnerability-class level). The attacker submits a crafted request over the network interface that exercises the authentication mechanism. Due to improper authentication, the request is processed with assumed authority rather than being rejected. No specific request format, token, header, or parameter can be described, as it is not provided in the authoritative data.

4. Post-exploitation impact. With the bypassed/weak authentication accepted, the attacker gains access to controller functionality consistent with C:H/I:H — reading sensitive configuration and project data, and, most consequentially, modifying controller logic or operating parameters. On a PLC/HMI this can translate to manipulated physical processes, altered setpoints, disabled safety interlocks (if implemented in controller logic), or reconnaissance of the wider OT environment. A:L reflects potential partial disruption of device availability.

Impact Assessment

• Confidentiality (C:H). Controller configuration, project logic, tag/register data, and connection credentials for downstream systems are at high risk of disclosure. In OT environments, this data is the blueprint for further lateral movement and process manipulation.
• Integrity (I:H). High-integrity impact against a process controller is the most severe dimension. Unauthorized modification of PLC logic or live values can alter or disable physical operations.
• Availability (A:L). Partial loss of availability is anticipated (e.g., a controller function becoming unstable or unresponsive), but not guaranteed full DoS.
• Scope (S:U) / PR:L. Impact is confined to the vulnerable component and requires a low-privilege foothold, tempering the score relative to a fully unauthenticated RCE.

Blast radius. Directly affected: Unitronics UniStream Pro B10/C10 controllers running UniLogic < 1.41.329. Because these are integrated PLC/HMI devices, secondary impact extends to connected sensors, actuators, drives, and supervisory systems on the same OT segment. Sectors historically targeted for Unitronics exploitation — water/wastewater, food and beverage, manufacturing, and building automation — face elevated risk. Internet-exposed instances face the greatest exposure given AV:N and AC:L.

Note: This CVE is not listed in CISA KEV, has no EPSS score published by FIRST.org, and has no known public exploit.

Detection Guidance

Detection should focus on anomalous network sessions to UniStream Pro controller management/runtime interfaces and on authentication events that should not succeed. Because no protocol details are disclosed, rules are written at the network and authentication-event level.

Sigma Rule

title: Potential UniStream Pro Improper Authentication Abuse (CVE-2026-45451)
id: 7b2e9f14-3c4a-4d1e-9a55-uni45451a
status: experimental
description: Detects repeated or anomalous authentication events targeting Unitronics UniStream Pro / UniLogic controller interfaces that may indicate attempts to bypass improper authentication controls.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-45451
author: valtersit.com Threat Intelligence
date: 2026-01-01
logsource:
  category: authentication
  product: unitronics
detection:
  selection_event:
    event.action:
      - 'login'
      - 'authentication'
  selection_result:
    event.outcome:
      - 'success'
      - 'unknown'
  selection_source:
    source.ip|cidr:
      - '0.0.0.0/0'
  condition: selection_event and selection_result
  timeframe: 5m
fields:
  - source.ip
  - user.name
  - event.outcome
falsepositives:
  - Legitimate engineering workstation sessions during commissioning
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.45451

YARA Rule

rule CVE_2026_45451_UniLogic_UniStream_Pro
{
    meta:
        description = "Detects UniLogic/UniStream Pro artifacts associated with CVE-2026-45451 affected versions prior to 1.41.329"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-45451"
        author = "valtersit.com Threat Intelligence"
        date = "2026-01-01"
        severity = "high"

    strings:
        $prod1 = "UniStream Pro" ascii nocase
        $prod2 = "UniLogic" ascii nocase
        $model1 = "B10" ascii
        $model2 = "C10" ascii
        $ver = /UniLogic[^0-9]{0,8}1\.(3[0-9]|4[0-0])\.[0-9]{1,3}/ ascii nocase

    condition:
        uint16(0) == 0x5A4D and
        (($prod1 or $prod2) and ($model1 or $model2) or $ver)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-45451 Possible Unitronics UniStream Pro Improper Authentication Attempt"; flow:to_server,established; content:"UniStream"; nocase; content:"UniLogic"; nocase; distance:0; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-admin; reference:cve,2026-45451; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-45451; sid:90045451; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where destination.port in (80, 443, 502, 44818, 102)]
  [authentication where event.outcome == "success" and not user.name in ("admin", "maintenance")]

Rationale: correlates a network connection toward typical controller/industrial ports with an immediate successful authentication event not matching known administrative accounts — a pattern consistent with an improper-authentication bypass.

Splunk SPL Query

index=ot OR index=network sourcetype IN ("suricata:alert","pan:traffic","unitronics:*")
| search ("UniStream" OR "UniLogic" OR cve="2026-45451")
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as sources values(dest) as destinations by dest_port, signature
| where count > 3
| sort - count
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")

Wazuh OSSEC Rule

<group name="unitronics,cve-2026-45451,">
  <rule id="100451" level="12">
    <if_sid>5700</if_sid>
    <match>UniStream|UniLogic</match>
    <description>CVE-2026-45451: Possible UniStream Pro improper authentication activity detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>initial_access,pci_dss_10.2.4,pci_dss_10.2.5,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or official advisory was available in the tracked sources at the time of writing.

1. Immediate mitigations

   • Network isolation. Place UniStream Pro B10/C10 controllers behind strict firewall/segmentation controls; never expose them directly to the internet or to general IT VLANs. Enforce OT/IT segmentation and deny inbound access to controller management/runtime interfaces from untrusted zones.
   • Access control. Restrict access to UniLogic engineering workstations and controller interfaces to named, least-privilege accounts and specific source hosts. Because CVSS requires PR:L, eliminating low-privilege or default-credential access reduces exploitability.
   • Credential hygiene. Rotate any default or shared credentials on controllers and UniLogic deployments; audit for accounts that can satisfy the authentication path.
   • Monitoring. Deploy the detection content above to surface anomalous authentication successes toward controller assets.
   • Compensating control. Where feasible, insert a managed industrial firewall/switch that enforces an allow-list of engineering workstations permitted to reach each controller.

2. Patch / upgrade steps

   • Monitor Unitronics for a fixed UniLogic release addressing CVE-2026-45451 and confirm the corrective version against the affected baseline (UniLogic prior to 1.41.329). No validated patch version is currently available per tracked sources.
   • Once a fix is published, stage-upgrade UniLogic on engineering workstations, redeploy/verify controller project integrity, and re-baseline the affected B10/C10 units.
   • Until then, treat the fixed threshold of "1.41.329" as the reference target only if the vendor confirms it resolves the flaw — do not assume resolution without vendor confirmation.

3. Long-term hardening

   • Adopt a formal OT patch-management program with vendor liaison for controller firmware/toolchain.
   • Enforce role-based access and multifactor authentication at any gateway fronting controller access.
   • Maintain offline/immutable backups of PLC projects and configuration to enable rapid restoration after tampering (given I:H impact).
   • Perform periodic network exposure audits (Shodan/Censys self-checks) to confirm no controllers are internet-reachable.

References

1. NVD — CVE-2026-45451: https://nvd.nist.gov/vuln/detail/CVE-2026-45451
2. MITRE CWE-287 — Improper Authentication: https://cwe.mitre.org/data/definitions/287.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. Unitronics product/security documentation (vendor): https://www.unitronicsplc.com/
5. CISA Industrial Control Systems advisories (for related Unitronics ICS guidance): https://www.cisa.gov/ics

Exploit-in-the-wild / threat actor note: No public exploit, PoC, or KEV listing exists for CVE-2026-45451 as of this report. No specific threat actor campaign is attributed. Historically, Unitronics PLC/HMI devices have been targeted by OT-focused actors, so defenders should prioritize exposure reduction even absent confirmed in-the-wild activity for this specific CVE.