CVE-2026-45452: CWE-134 Use of Externally-Controlled format string in Unitronics Unitronics UniStream Pro/UniLogic

This vulnerability (CWE-134) in Unitronics UniStream Pro/UniLogic arises from the use of externally-controlled format strings, which can be exploited to compromise the confidentiality and integrity of the system. It affects Unitronics UniStream Pro versions B10 and C10 and UniLogic versions before 1.41.329. The CVSS 3.1 base score is 8.3, indicating a high severity with network attack vector, low attack complexity, requiring low privileges and no user interaction, and resulting in high confidentiality and integrity impacts and low availability impact.

Successful exploitation could allow an attacker with low privileges to execute format string attacks remotely, potentially leading to disclosure of sensitive information and modification of data, impacting confidentiality and integrity. Availability impact is low. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor Unitronics advisories for updates and apply patches once available.