CVE-2026-45452

Executive Summary

CVE-2026-45452 is a use of externally-controlled format string vulnerability (CWE-134) affecting Unitronics UniStream Pro/UniLogic, specifically UniStream Pro versions B10 and C10 running UniLogic versions prior to 1.41.329. An authenticated remote attacker can supply malicious format string input to a vulnerable component, potentially leading to memory disclosure, memory corruption, and arbitrary code execution or denial of service. With a CVSS base score of 8.3 (High), the vulnerability poses significant risk to operational technology (OT) environments using these programmable logic controllers (PLCs) for industrial automation.

Technical Analysis

This vulnerability is classified as CWE-134: Use of Externally-Controlled Format String. In this class of vulnerability, the application accepts input from an external source and uses it as a format string argument in a formatting function (such as those in the C printf family). Because the format string is not validated or sanitized, an attacker can include format specifiers (e.g., %x, %s, %n) that cause the application to read from or write to memory locations not intended by the developer.

The affected product is Unitronics UniStream Pro, a series of programmable logic controllers (PLCs) with integrated HMI capabilities. The specific models identified are B10 and C10. The vulnerability exists in UniLogic, the programming environment and runtime firmware used with these devices, in versions prior to 1.41.329. The CVSS vector indicates the attack is network-accessible (AV:N), requires low privileges (PR:L), requires no user interaction (UI:N), and can result in high confidentiality impact (C:H), high integrity impact (I:H), and low availability impact (A:L). This suggests that an attacker with authenticated access to the device or its management interface could exploit the format string flaw to disclose sensitive memory contents, modify memory, or cause a partial denial of service.

No public proof-of-concept, exploit code, or Nuclei template has been identified. The description provided does not specify the exact input vector (e.g., web interface, network protocol, or file upload) or the precise component within UniLogic that is vulnerable. Therefore, the attack surface is inferred at the vulnerability-class level: any externally reachable interface that processes user-supplied strings through a formatting function is a potential vector. Given the device's role as an OT controller, network-exposed services such as the web server, configuration interfaces, or proprietary protocols could be entry points.

Exploitation Scenarios

1) Reconnaissance/target identification: An attacker scans the network for Unitronics UniStream Pro devices, potentially using Shodan dorks such as product:"Unitronics" or http.html:"UniLogic" to identify internet-exposed instances. Alternatively, in a targeted OT attack, the adversary performs internal network discovery to locate PLCs on the industrial control network.

2) Triggering the flaw: The attacker must first authenticate to the device or management interface with low privileges (as indicated by PR:L). Once authenticated, they identify an input field or communication endpoint that accepts a string and passes it unsanitized to a formatting function. Because the NVD description does not specify the exact vulnerable parameter, the attacker would likely fuzz accessible input vectors—such as web form fields, API parameters, or protocol messages—with format specifiers like %x, %s, %n to observe memory leaks or crashes.

3) Payload/execution method: The attacker crafts a payload containing malicious format specifiers. By using %n specifiers, they may attempt to write arbitrary values to memory addresses, potentially overwriting function pointers or return addresses to redirect execution flow. Alternatively, %s specifiers can be used to read and leak memory contents, bypassing ASLR or disclosing credentials. The exact exploitation technique depends on the binary's protections and the memory layout, which are not detailed in the available intelligence.

4) Post-exploitation impact: Successful exploitation could allow the attacker to read sensitive data from device memory (e.g., credentials, configuration), modify control logic or firmware, cause a denial of service by crashing the device, or achieve arbitrary code execution on the PLC. In an OT context, this could disrupt physical processes, manipulate industrial equipment, or serve as a pivot point into the broader control network.

Note: No public PoC is available; the attack chain is inferred from the vulnerability class and CVSS vector. Specific implementation details (function names, endpoints, parameters) are not present in the NVD description and have not been fabricated.

Impact Assessment

The CVSS v3.1 base score is 8.3 (High), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. This indicates:

• Confidentiality (High): Memory disclosure could expose sensitive operational data, credentials, or proprietary logic.
• Integrity (High): An attacker could alter control logic, configuration, or firmware, compromising the integrity of industrial processes.
• Availability (Low): Exploitation may cause a partial denial of service, potentially disrupting device availability, though the low rating suggests limited impact on availability.
• Scope (Unchanged): The vulnerability does not cross security boundaries; impact is confined to the vulnerable component.

Affected systems are Unitronics UniStream Pro B10 and C10 PLCs running UniLogic versions prior to 1.41.329. These devices are typically deployed in manufacturing, water treatment, energy, and other critical infrastructure sectors. The blast radius includes any process controlled by the PLC, as well as connected systems that trust the PLC's data. Given the device's role in OT, a compromise could lead to physical consequences, safety incidents, or production downtime. The EPSS score is not yet available, and there is no evidence of active exploitation in the wild or inclusion in CISA KEV.

Detection Guidance

Sigma Rule

title: Potential Format String Exploitation Attempt Against Unitronics UniStream Pro
id: 8f4c2e1a-9b3d-4a7c-8e2f-1d5c6b8a9e0f
status: experimental
description: Detects network requests or logs containing format string specifiers targeting Unitronics UniLogic interfaces.
author: Threat Intelligence Team
date: 2026-01-01
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-uri-query|contains:
      - '%x'
      - '%s'
      - '%n'
      - '%p'
      - '%20$'
  condition: selection
falsepositives:
  - Legitimate use of percent-encoded characters in URLs
level: medium
tags:
  - attack.t1190
  - cwe.134

YARA Rule

rule CVE_2026_45452_Unitronics_FormatString
{
    meta:
        description = "Detects format string specifiers in input destined for Unitronics UniStream Pro/UniLogic"
        author = "Threat Intelligence Team"
        date = "2026-01-01"
        reference = "CVE-2026-45452"
        severity = "high"
    strings:
        $fmt1 = "%n" ascii wide
        $fmt2 = "%s" ascii wide
        $fmt3 = "%x" ascii wide
        $fmt4 = "%p" ascii wide
        $unitronics = "Unitronics" ascii wide nocase
        $unilogic = "UniLogic" ascii wide nocase
    condition:
        ($unitronics or $unilogic) and any of ($fmt*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-45452 Unitronics UniStream Pro Format String Attempt"; flow:established,to_server; content:"Unitronics"; http_header; nocase; content:"%n"; http_uri; nocase; content:"%s"; http_uri; nocase; classtype:attempted-admin; reference:cve,2026-45452; sid:1000001; rev:1;)

Elastic Detection

network where
  http.request.uri : ("*%n*" or "*%s*" or "*%x*" or "*%p*") and
  (http.request.headers : "*Unitronics*" or http.request.headers : "*UniLogic*")

Splunk SPL Query

index=web OR index=network
| search ("%n" OR "%s" OR "%x" OR "%p") AND ("Unitronics" OR "UniLogic")
| stats count by src_ip, dest_ip, uri, user_agent
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="unitronics,">
  <rule id="100100" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.*%[nxsxp]</field>
    <description>CVE-2026-45452: Possible format string exploitation attempt against Unitronics UniStream Pro</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_45452,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict network access to UniStream Pro devices. Place them behind a firewall and allow only trusted management hosts to reach the web interface or configuration services.
   • Disable remote management features if not required for operations.
   • Enforce strong authentication and least-privilege principles for any accounts that can access the device.
   • Monitor network traffic for format string specifiers (e.g., %n, %s, %x) targeting the devices, using the Suricata rule above.
   • Segment OT networks from IT networks to limit lateral movement.

2. Patch/upgrade steps:

   • No official patch is currently available. Monitor the Unitronics security advisory page for updates. When a fixed version of UniLogic is released, upgrade to version 1.41.329 or later.
   • Subscribe to vendor notifications and CVE feeds for this product line.

3. Long-term hardening:

   • Implement input validation and sanitization on all external inputs in custom applications interacting with the PLC.
   • Conduct regular security assessments of OT devices, including fuzz testing of network-facing interfaces.
   • Apply the principle of least privilege for device accounts and enforce multi-factor authentication where supported.
   • Maintain an inventory of all UniStream Pro devices and their firmware versions to facilitate rapid response.

References

1. NVD – CVE-2026-45452: https://nvd.nist.gov/vuln/detail/CVE-2026-45452
2. Unitronics Security Advisories: https://www.unitronicsplc.com/security-advisories/
3. CWE-134: Use of Externally-Controlled Format String: https://cwe.mitre.org/data/definitions/134.html
4. CISA ICS Advisory (if published): https://www.cisa.gov/ics-advisories
5. FIRST EPSS: https://www.first.org/epss/ (score not yet available)

No known threat actor campaigns or exploit-in-the-wild evidence have been identified for this vulnerability at the time of writing.