CVE-2026-45449 PUBLISHED

Unitronics - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner: INCD
Reserved: 12.05.2026 Published: 15.10.2026 Updated: 15.10.2026

: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.

This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CVSS Score: 8.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	Unitronics
Product	Unitronics UniStream Pro/UniLogic
Versions	Default: unaffected Version Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329 is affected

Solutions

Upgrade UniLogic and UniStream to version 1.41.329 or above

Credits

SemanticGuard finder

References

https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0

Problem Types

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE