CVE-2026-45449: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Unitronics Unitronics UniStream Pro/UniLogic

This vulnerability (CVE-2026-45449) affects Unitronics UniStream Pro (B10 / C10) and UniLogic versions prior to 1.41.329. It is classified as CWE-78, which involves improper neutralization of special elements in OS commands, commonly known as OS Command Injection. This flaw could allow an attacker with low privileges and no user interaction to execute arbitrary OS commands, impacting confidentiality, integrity, and availability of the affected system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, and privileges required are low.

Successful exploitation could lead to execution of arbitrary OS commands with the privileges of the affected application, resulting in high confidentiality and integrity impact, and low availability impact. This could allow attackers to compromise the system, access sensitive data, or disrupt operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, restrict access to affected systems and monitor for suspicious activity related to OS command execution.