Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-45452 (GCVE-0-2026-45452)

Vulnerability from nvd – Published: 2026-10-15 15:25 – Updated: 2026-10-15 17:59

Title

Unitronics - CWE-134 Use of Externally-Controlled format string

Summary

Use of Externally-Controlled format string vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.

Severity

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 17:58 UTC

CWE

CWE-134 - Use of Externally-Controlled format string

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

1 reference

URL	Tags
https://www.gov.il/en/departments/dynamiccollecto…

Impacted products

1 product

Vendor	Product	Version
Unitronics	Unitronics UniStream Pro/UniLogic	Affected: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329

Date Public

2026-10-15 15:13

Credits

SemanticGuard

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45452",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T17:58:47.636535Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T17:59:46.210Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unitronics UniStream Pro/UniLogic",
          "vendor": "Unitronics",
          "versions": [
            {
              "status": "affected",
              "version": "Unitronics UniStream Pro versions only (B10 / C10) \u2013 UniLogic versions prior to 1.41.329"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SemanticGuard"
        }
      ],
      "datePublic": "2026-10-15T15:13:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use of Externally-Controlled format string vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.\u003cp\u003eThis issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) \u2013 UniLogic versions prior to 1.41.329.\u003c/p\u003e"
            }
          ],
          "value": "Use of Externally-Controlled format string vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.\n\nThis issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) \u2013 UniLogic versions prior to 1.41.329."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-134",
              "description": "CWE-134 Use of Externally-Controlled format string",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T15:25:54.445Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003ctable\u003e\n \n \u003ctbody\u003e\u003ctr\u003e\n\n  \u003ctd\u003e\u003ctable\u003e\n \n \u003ctbody\u003e\u003ctr\u003e\n\n  \u003ctd\u003eUpgrade UniLogic and UniStream to version 1.42.220 or above\u003c/td\u003e\n\n \u003c/tr\u003e\n\u003c/tbody\u003e\u003c/table\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
            }
          ],
          "value": "Upgrade UniLogic and UniStream to version 1.42.220 or above"
        }
      ],
      "source": {
        "advisory": "ILVN-2025-0264",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics - CWE-134 Use of Externally-Controlled format string",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2026-45452",
    "datePublished": "2026-10-15T15:25:54.445Z",
    "dateReserved": "2026-05-12T15:11:23.921Z",
    "dateUpdated": "2026-10-15T17:59:46.210Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-45451 (GCVE-0-2026-45451)

Vulnerability from nvd – Published: 2026-10-15 15:23 – Updated: 2026-10-15 18:00

Title

Unitronics - CWE-287: Improper Authentication

Summary

: Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.

Severity

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 18:00 UTC

CWE

CWE-287 - Improper Authentication

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

1 reference

URL	Tags
https://www.gov.il/en/departments/dynamiccollecto…

Impacted products

1 product

Vendor	Product	Version
Unitronics	Unitronics UniStream Pro/UniLogic	Affected: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329

Date Public

2026-10-15 15:13

Credits

SemanticGuard

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45451",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T18:00:17.370132Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T18:00:27.448Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unitronics UniStream Pro/UniLogic",
          "vendor": "Unitronics",
          "versions": [
            {
              "status": "affected",
              "version": "Unitronics UniStream Pro versions only (B10 / C10) \u2013 UniLogic versions prior to 1.41.329"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SemanticGuard"
        }
      ],
      "datePublic": "2026-10-15T15:13:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": ": Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.\u003cp\u003eThis issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) \u2013 UniLogic versions prior to 1.41.329.\u003c/p\u003e"
            }
          ],
          "value": ": Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.\n\nThis issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) \u2013 UniLogic versions prior to 1.41.329."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T15:23:55.464Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003ctable\u003e\n \n \u003ctbody\u003e\u003ctr\u003e\n\n  \u003ctd\u003e\u003ctable\u003e\n \n \u003ctbody\u003e\u003ctr\u003e\n\n  \u003ctd\u003eUpgrade UniLogic and UniStream to version 1.42.220 or above\u003c/td\u003e\n\n \u003c/tr\u003e\n\u003c/tbody\u003e\u003c/table\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
            }
          ],
          "value": "Upgrade UniLogic and UniStream to version 1.42.220 or above"
        }
      ],
      "source": {
        "advisory": "ILVN-2025-0263",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics - CWE-287: Improper Authentication",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2026-45451",
    "datePublished": "2026-10-15T15:23:55.464Z",
    "dateReserved": "2026-05-12T15:11:23.921Z",
    "dateUpdated": "2026-10-15T18:00:27.448Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-45450 (GCVE-0-2026-45450)

Vulnerability from nvd – Published: 2026-10-15 15:21 – Updated: 2026-10-15 18:01

Title

Unitronics - CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

Summary

: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.

Severity

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 18:00 UTC

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

1 reference

URL	Tags
https://www.gov.il/en/departments/dynamiccollecto…

Impacted products

1 product

Vendor	Product	Version
Unitronics	Unitronics UniStream Pro/UniLogic	Affected: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329

Date Public

2026-10-15 15:13

Credits

SemanticGuard

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45450",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T18:00:51.546802Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T18:01:17.303Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unitronics UniStream Pro/UniLogic",
          "vendor": "Unitronics",
          "versions": [
            {
              "status": "affected",
              "version": "Unitronics UniStream Pro versions only (B10 / C10) \u2013 UniLogic versions prior to 1.41.329"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SemanticGuard"
        }
      ],
      "datePublic": "2026-10-15T15:13:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": ": Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.\u003cp\u003eThis issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) \u2013 UniLogic versions prior to 1.41.329.\u003c/p\u003e"
            }
          ],
          "value": ": Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.\n\nThis issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) \u2013 UniLogic versions prior to 1.41.329."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T15:21:41.203Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003ctable\u003e\n \n \u003ctbody\u003e\u003ctr\u003e\n\n  \u003ctd\u003e\u003ctable\u003e\n \n \u003ctbody\u003e\u003ctr\u003e\n\n  \u003ctd\u003eUpgrade UniLogic and UniStream to version 1.42.220 or above\u003c/td\u003e\n\n \u003c/tr\u003e\n\u003c/tbody\u003e\u003c/table\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
            }
          ],
          "value": "Upgrade UniLogic and UniStream to version 1.42.220 or above"
        }
      ],
      "source": {
        "advisory": "ILVN-2025-0262",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics - CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2026-45450",
    "datePublished": "2026-10-15T15:21:41.203Z",
    "dateReserved": "2026-05-12T15:11:23.921Z",
    "dateUpdated": "2026-10-15T18:01:17.303Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-45449 (GCVE-0-2026-45449)

Vulnerability from nvd – Published: 2026-10-15 15:18 – Updated: 2026-10-15 18:06

Title

Unitronics - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Summary

: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.

Severity

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 18:05 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

1 reference

URL	Tags
https://www.gov.il/en/departments/dynamiccollecto…

Impacted products

1 product

Vendor	Product	Version
Unitronics	Unitronics UniStream Pro/UniLogic	Affected: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329

Date Public

2026-10-15 15:13

Credits

SemanticGuard

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45449",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T18:05:49.669716Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T18:06:03.223Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unitronics UniStream Pro/UniLogic",
          "vendor": "Unitronics",
          "versions": [
            {
              "status": "affected",
              "version": "Unitronics UniStream Pro versions only (B10 / C10) \u2013 UniLogic versions prior to 1.41.329"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SemanticGuard"
        }
      ],
      "datePublic": "2026-10-15T15:13:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": ": Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.\u003cp\u003eThis issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) \u2013 UniLogic versions prior to 1.41.329.\u003c/p\u003e"
            }
          ],
          "value": ": Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.\n\nThis issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) \u2013 UniLogic versions prior to 1.41.329."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T15:18:59.438Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003ctable\u003e\n \n \u003ctbody\u003e\u003ctr\u003e\n\n  \u003ctd\u003eUpgrade UniLogic and UniStream to version 1.41.329 or above\u003c/td\u003e\n\n \u003c/tr\u003e\n\u003c/tbody\u003e\u003c/table\u003e"
            }
          ],
          "value": "Upgrade UniLogic and UniStream to version 1.41.329 or above"
        }
      ],
      "source": {
        "advisory": "ILVN-2025-0261",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics - CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2026-45449",
    "datePublished": "2026-10-15T15:18:59.438Z",
    "dateReserved": "2026-05-12T15:11:23.921Z",
    "dateUpdated": "2026-10-15T18:06:03.223Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-38435 (GCVE-0-2024-38435)

Vulnerability from nvd – Published: 2024-07-21 07:10 – Updated: 2024-08-02 04:12

Title

Unitronics Vision PLC - CWE-703: Improper Check or Handling of Exceptional Conditions

Summary

Unitronics Vision PLC – CWE-703: Improper Check or Handling of Exceptional Conditions may allow denial of service

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-07-22 11:51 UTC

CWE

CWE-703 - Improper Check or Handling of Exceptional Conditions

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

1 reference

URL	Tags
https://www.gov.il/en/Departments/faq/cve_advisories

Impacted products

1 product

Vendor	Product	Version
Unitronics	Vision PLC	Affected: All versions , < Upgrade to v9.9.1 (custom)

Date Public

2024-07-18 07:05

Credits

Claroty Research – Team 82

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38435",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-22T11:51:46.970559Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-22T11:51:57.805Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:12:24.743Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.gov.il/en/Departments/faq/cve_advisories"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Vision PLC",
          "vendor": "Unitronics",
          "versions": [
            {
              "lessThan": "Upgrade to v9.9.1",
              "status": "affected",
              "version": "All versions",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Claroty Research \u2013 Team 82"
        }
      ],
      "datePublic": "2024-07-18T07:05:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUnitronics Vision PLC \u2013\u0026nbsp;\u003c/span\u003eCWE-703: Improper Check or Handling of Exceptional Conditions may allow denial of service\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cp\u003e\u0026nbsp;\u003c/p\u003e\n\n\u003c/span\u003e"
            }
          ],
          "value": "Unitronics Vision PLC \u2013\u00a0CWE-703: Improper Check or Handling of Exceptional Conditions may allow denial of service"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-703",
              "description": "CWE-703: Improper Check or Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-21T07:10:04.460Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/Departments/faq/cve_advisories"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUpgrade to v9.9.1\u003c/span\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Upgrade to v9.9.1"
        }
      ],
      "source": {
        "advisory": "ILVN-2024-0173",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics Vision PLC - CWE-703: Improper Check or Handling of Exceptional Conditions",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2024-38435",
    "datePublished": "2024-07-21T07:10:04.460Z",
    "dateReserved": "2024-06-16T08:00:52.286Z",
    "dateUpdated": "2024-08-02T04:12:24.743Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-38434 (GCVE-0-2024-38434)

Vulnerability from nvd – Published: 2024-07-21 07:08 – Updated: 2024-08-02 04:12

Title

Unitronics Vision PLC - CWE-676: Use of Potentially Dangerous Function

Summary

Unitronics Vision PLC – CWE-676: Use of Potentially Dangerous Function may allow security feature bypass

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-07-29 14:56 UTC

CWE

CWE-676 - Use of Potentially Dangerous Function

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

1 reference

URL	Tags
https://www.gov.il/en/Departments/faq/cve_advisories

Impacted products

1 product

Vendor	Product	Version
Unitronics	Vision PLC	Affected: All versions , < Upgrade to v9.9.1 (custom)

Date Public

2024-07-18 07:05

Credits

Claroty Research – Team 82

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38434",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-29T14:56:41.036778Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-29T14:56:57.915Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:12:24.698Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.gov.il/en/Departments/faq/cve_advisories"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Vision PLC",
          "vendor": "Unitronics",
          "versions": [
            {
              "lessThan": "Upgrade to v9.9.1",
              "status": "affected",
              "version": "All versions",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Claroty Research \u2013 Team 82"
        }
      ],
      "datePublic": "2024-07-18T07:05:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUnitronics Vision PLC \u2013  \n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eCWE-676: Use of Potentially Dangerous Function\u003c/span\u003e\u003cb\u003e\u0026nbsp;\u003c/b\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003emay allow security feature bypass\u003c/span\u003e\n\n\u003c/span\u003e"
            }
          ],
          "value": "Unitronics Vision PLC \u2013  \n\nCWE-676: Use of Potentially Dangerous Function\u00a0may allow security feature bypass"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-676",
              "description": "CWE-676: Use of Potentially Dangerous Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-21T07:08:52.056Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/Departments/faq/cve_advisories"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUpgrade to v9.9.1\u003c/span\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Upgrade to v9.9.1"
        }
      ],
      "source": {
        "advisory": "ILVN-2024-0172",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics Vision PLC - CWE-676: Use of Potentially Dangerous Function",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2024-38434",
    "datePublished": "2024-07-21T07:08:52.056Z",
    "dateReserved": "2024-06-16T08:00:52.285Z",
    "dateUpdated": "2024-08-02T04:12:24.698Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-1480 (GCVE-0-2024-1480)

Vulnerability from nvd – Published: 2024-04-19 21:19 – Updated: 2024-08-01 18:40

Title

Unitronics Vision Standard Unauthenticated Password Retrieval

Summary

Unitronics Vision Standard line of controllers allow the Information Mode password to be retrieved without authentication.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-04-20 19:55 UTC

CWE

CWE-257 - Storing Passwords in a Recoverable Format

Assigner

Dragos CNA under the icscert root

CNA scorecard – unranked: 0 records in the last 180 days, 10 needed details

References

2 references

URL	Tags
https://www.cisa.gov/news-events/ics-advisories/i…
https://www.dragos.com/advisory/unitronics-vision…

Impacted products

5 products

Vendor	Product	Version
Unitronics	Vision230	Affected: 0
Unitronics	Vision280	Affected: 0
Unitronics	Vision290	Affected: 0
Unitronics	Vision530	Affected: 0
Unitronics	Vision120	Affected: 0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-1480",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-20T19:55:11.495288Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-23T18:46:06.919Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:40:21.234Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-109-01"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.dragos.com/advisory/unitronics-vision-standard/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Vision230",
          "vendor": "Unitronics",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Vision280",
          "vendor": "Unitronics",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Vision290",
          "vendor": "Unitronics",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Vision530",
          "vendor": "Unitronics",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Vision120",
          "vendor": "Unitronics",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unitronics Vision Standard line of controllers allow the Information Mode password to be retrieved without authentication."
            }
          ],
          "value": "Unitronics Vision Standard line of controllers allow the Information Mode password to be retrieved without authentication."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-114",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-114 Authentication Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-257",
              "description": "CWE-257 Storing Passwords in a Recoverable Format",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-19T21:19:27.592Z",
        "orgId": "12bdf821-1545-4a87-aac5-61670cc6fcef",
        "shortName": "Dragos"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-109-01"
        },
        {
          "url": "https://www.dragos.com/advisory/unitronics-vision-standard/"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Unitronics Vision Standard Unauthenticated Password Retrieval",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "12bdf821-1545-4a87-aac5-61670cc6fcef",
    "assignerShortName": "Dragos",
    "cveId": "CVE-2024-1480",
    "datePublished": "2024-04-19T21:19:27.592Z",
    "dateReserved": "2024-02-13T18:49:36.966Z",
    "dateUpdated": "2024-08-01T18:40:21.234Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-27774 (GCVE-0-2024-27774)

Vulnerability from nvd – Published: 2024-03-18 13:34 – Updated: 2024-08-02 00:41

Title

Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-259: Use of Hard-coded Password

Summary

Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-259: Use of Hard-coded Password may allow disclosing Sensitive Information Embedded inside Device's Firmware

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-20 21:32 UTC

CWE

CWE-259 - Use of Hard-coded Password

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

2 references

URL	Tags
https://www.gov.il/en/departments/dynamiccollecto…
https://claroty.com/team82/blog/new-critical-vuln…

Impacted products

2 products

Vendor	Product	Version
Unitronics	Unistream Unilogic	Affected: All versions , < 1.35.227 (custom)
unitronics	unistream_unilogic	Affected: 0 , < 1.35.227 (custom) cpe:2.3:a:unitronics:unistream_unilogic::::::::

Date Public

2024-03-18 14:00

Credits

Noam Moshe, Vera Mens of Claroty Team82

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:unitronics:unistream_unilogic:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "unistream_unilogic",
            "vendor": "unitronics",
            "versions": [
              {
                "lessThan": "1.35.227",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27774",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-20T21:32:07.422871Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-20T21:32:26.836Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:41:54.444Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unistream Unilogic",
          "vendor": "Unitronics ",
          "versions": [
            {
              "lessThan": "1.35.227",
              "status": "affected",
              "version": "All versions",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Noam Moshe, Vera Mens of Claroty Team82"
        }
      ],
      "datePublic": "2024-03-18T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 -\n\n\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eCWE-259: Use of Hard-coded Password may allow disclosing Sensitive Information Embedded inside Device\u0027s Firmware\u003c/span\u003e\n\n\u003c/span\u003e\n\n\u003c/span\u003e\n\n\n\n\n\n\n\n\u003c/span\u003e\n\n\u003c/span\u003e\n\n"
            }
          ],
          "value": "\nUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 -\n\nCWE-259: Use of Hard-coded Password may allow disclosing Sensitive Information Embedded inside Device\u0027s Firmware\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-259",
              "description": "CWE-259: Use of Hard-coded Password",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-18T13:34:31.538Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
        },
        {
          "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUpgrade to version 1.35.227 or later.\u003c/span\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "\nUpgrade to version 1.35.227 or later.\n\n"
        }
      ],
      "source": {
        "advisory": "ILVN-2024-0154",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics Unistream Unilogic \u2013 Versions prior to 1.35.227  CWE-259: Use of Hard-coded Password",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2024-27774",
    "datePublished": "2024-03-18T13:34:31.538Z",
    "dateReserved": "2024-02-26T09:27:55.323Z",
    "dateUpdated": "2024-08-02T00:41:54.444Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-27773 (GCVE-0-2024-27773)

Vulnerability from nvd – Published: 2024-03-18 13:32 – Updated: 2024-08-02 00:41

Title

Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-348: Use of Less Trusted Source

Summary

Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-348: Use of Less Trusted Source may allow RCE

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-03-21 15:33 UTC

CWE

CWE-348 - Use of Less Trusted Source

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

2 references

URL	Tags
https://www.gov.il/en/departments/dynamiccollecto…
https://claroty.com/team82/blog/new-critical-vuln…

Impacted products

2 products

Vendor	Product	Version
Unitronics	Unistream Unilogic	Affected: All versions , < 1.35.227 (custom)
unitronics	unistream_unilogic	Affected: 0 , < 1.35.227 (custom) cpe:2.3:a:unitronics:unistream_unilogic::::::::

Date Public

2024-03-18 14:00

Credits

Noam Moshe, Vera Mens of Claroty Team82

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:unitronics:unistream_unilogic:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "unistream_unilogic",
            "vendor": "unitronics",
            "versions": [
              {
                "lessThan": "1.35.227",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27773",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-21T15:33:05.323875Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-20T21:27:28.047Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:41:54.422Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unistream Unilogic",
          "vendor": "Unitronics ",
          "versions": [
            {
              "lessThan": "1.35.227",
              "status": "affected",
              "version": "All versions",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Noam Moshe, Vera Mens of Claroty Team82"
        }
      ],
      "datePublic": "2024-03-18T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 -\n\n\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eCWE-348: Use of Less Trusted Source may allow RCE\u003c/span\u003e\n\n\u003c/span\u003e\n\n\n\n\n\n\n\n\u003c/span\u003e\n\n\u003c/span\u003e\n\n"
            }
          ],
          "value": "\nUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 -\n\nCWE-348: Use of Less Trusted Source may allow RCE\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-348",
              "description": "CWE-348: Use of Less Trusted Source",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-18T13:32:46.698Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
        },
        {
          "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUpgrade to version 1.35.227 or later.\u003c/span\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "\nUpgrade to version 1.35.227 or later.\n\n"
        }
      ],
      "source": {
        "advisory": "ILVN-2024-0153",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics Unistream Unilogic \u2013 Versions prior to 1.35.227  CWE-348: Use of Less Trusted Source",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2024-27773",
    "datePublished": "2024-03-18T13:32:46.698Z",
    "dateReserved": "2024-02-26T09:27:55.323Z",
    "dateUpdated": "2024-08-02T00:41:54.422Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-27772 (GCVE-0-2024-27772)

Vulnerability from nvd – Published: 2024-03-18 13:28 – Updated: 2024-08-02 00:41

Title

Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-78: 'OS Command Injection'

Summary

Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-78: 'OS Command Injection' may allow RCE

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-03-18 18:06 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

2 references

URL	Tags
https://www.gov.il/en/departments/dynamiccollecto…
https://claroty.com/team82/blog/new-critical-vuln…

Impacted products

2 products

Vendor	Product	Version
Unitronics	Unistream Unilogic	Affected: All versions , < 1.35.227 (custom)
unitronics	unistream_unilogic	Affected: 0 , < 1.35.227 (custom) cpe:2.3:a:unitronics:unistream_unilogic::::::::

Date Public

2024-03-18 14:00

Credits

Noam Moshe, Vera Mens of Claroty Team82

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:unitronics:unistream_unilogic:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "unistream_unilogic",
            "vendor": "unitronics",
            "versions": [
              {
                "lessThan": "1.35.227",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27772",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-18T18:06:12.435070Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-20T21:22:58.597Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:41:54.441Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unistream Unilogic",
          "vendor": "Unitronics ",
          "versions": [
            {
              "lessThan": "1.35.227",
              "status": "affected",
              "version": "All versions",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Noam Moshe, Vera Mens of Claroty Team82"
        }
      ],
      "datePublic": "2024-03-18T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 -\n\n\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eCWE-78: \u0027OS Command Injection\u0027 may allow RCE\u003c/span\u003e\n\n\n\n\n\n\n\n\u003c/span\u003e\n\n\u003c/span\u003e\n\n"
            }
          ],
          "value": "\nUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 -\n\nCWE-78: \u0027OS Command Injection\u0027 may allow RCE\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-18T13:28:35.731Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
        },
        {
          "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUpgrade to version 1.35.227 or later.\u003c/span\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "\nUpgrade to version 1.35.227 or later.\n\n"
        }
      ],
      "source": {
        "advisory": "ILVN-2024-0152",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics Unistream Unilogic \u2013 Versions prior to 1.35.227  CWE-78: \u0027OS Command Injection\u0027",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2024-27772",
    "datePublished": "2024-03-18T13:28:35.731Z",
    "dateReserved": "2024-02-26T09:27:55.323Z",
    "dateUpdated": "2024-08-02T00:41:54.441Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-27771 (GCVE-0-2024-27771)

Vulnerability from nvd – Published: 2024-03-18 13:27 – Updated: 2024-08-02 00:41

Title

Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-22: 'Path Traversal'

Summary

Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-22: 'Path Traversal' may allow RCE

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-03-18 18:20 UTC

CWE

CWE-22 - 'Path Traversal'

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

2 references

URL	Tags
https://www.gov.il/en/departments/dynamiccollecto…
https://claroty.com/team82/blog/new-critical-vuln…

Impacted products

2 products

Vendor	Product	Version
Unitronics	Unistream Unilogic	Affected: All versions , < 1.35.227 (custom)
unitronics	unistream_unilogic	Affected: 0 , < 1.35.227 (custom) cpe:2.3:a:unitronics:unistream_unilogic::::::::

Date Public

2024-03-18 14:00

Credits

Noam Moshe, Vera Mens of Claroty Team82

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:unitronics:unistream_unilogic:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "unistream_unilogic",
            "vendor": "unitronics",
            "versions": [
              {
                "lessThan": "1.35.227",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27771",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-18T18:20:07.973933Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-20T21:24:27.361Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:41:54.438Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unistream Unilogic",
          "vendor": "Unitronics ",
          "versions": [
            {
              "lessThan": "1.35.227",
              "status": "affected",
              "version": "All versions",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Noam Moshe, Vera Mens of Claroty Team82"
        }
      ],
      "datePublic": "2024-03-18T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 -\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eCWE-22: \u0027Path Traversal\u0027\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;may allow RCE\u003c/span\u003e\n\n\n\n\n\n\u003c/span\u003e\n\n\u003c/span\u003e\n\n"
            }
          ],
          "value": "\nUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 -\n\nCWE-22: \u0027Path Traversal\u0027\u00a0may allow RCE\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: \u0027Path Traversal\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-18T13:27:39.449Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
        },
        {
          "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUpgrade to version 1.35.227 or later.\u003c/span\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "\nUpgrade to version 1.35.227 or later.\n\n"
        }
      ],
      "source": {
        "advisory": "ILVN-2024-0151",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics Unistream Unilogic \u2013 Versions prior to 1.35.227  CWE-22: \u0027Path Traversal\u0027",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2024-27771",
    "datePublished": "2024-03-18T13:27:39.449Z",
    "dateReserved": "2024-02-26T09:27:55.323Z",
    "dateUpdated": "2024-08-02T00:41:54.438Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-27770 (GCVE-0-2024-27770)

Vulnerability from nvd – Published: 2024-03-18 13:23 – Updated: 2024-08-02 00:41

Title

Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-23: Relative Path Traversal

Summary

Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-23: Relative Path Traversal

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-03-18 18:20 UTC

CWE

CWE-23 - Relative Path Traversal

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

2 references

URL	Tags
https://www.gov.il/en/departments/dynamiccollecto…
https://claroty.com/team82/blog/new-critical-vuln…

Impacted products

2 products

Vendor	Product	Version
Unitronics	Unistream Unilogic	Affected: All versions , < 1.35.227 (custom)
unitronics	unistream_unilogic	Affected: 0 , < 1.35.227 (custom) cpe:2.3:a:unitronics:unistream_unilogic::::::::

Date Public

2024-03-18 14:00

Credits

Noam Moshe, Vera Mens of Claroty Team82

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:unitronics:unistream_unilogic:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "unistream_unilogic",
            "vendor": "unitronics",
            "versions": [
              {
                "lessThan": "1.35.227",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27770",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-18T18:20:07.973933Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-20T21:25:03.972Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:41:54.287Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unistream Unilogic",
          "vendor": "Unitronics ",
          "versions": [
            {
              "lessThan": "1.35.227",
              "status": "affected",
              "version": "All versions",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Noam Moshe, Vera Mens of Claroty Team82"
        }
      ],
      "datePublic": "2024-03-18T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 - \n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eCWE-23: Relative Path Traversal\u003c/span\u003e\n\n\u003c/span\u003e\n\n\u003c/span\u003e\n\n\u003c/span\u003e\n\n"
            }
          ],
          "value": "\nUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 - \n\nCWE-23: Relative Path Traversal\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "CWE-23: Relative Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-18T13:23:31.838Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
        },
        {
          "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUpgrade to version 1.35.227 or later.\u003c/span\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "\nUpgrade to version 1.35.227 or later.\n\n"
        }
      ],
      "source": {
        "advisory": "ILVN-2024-0150",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics Unistream Unilogic \u2013 Versions prior to 1.35.227  CWE-23: Relative Path Traversal",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2024-27770",
    "datePublished": "2024-03-18T13:23:31.838Z",
    "dateReserved": "2024-02-26T09:27:55.323Z",
    "dateUpdated": "2024-08-02T00:41:54.287Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-27769 (GCVE-0-2024-27769)

Vulnerability from nvd – Published: 2024-03-18 13:21 – Updated: 2025-04-10 20:24

Title

Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Summary

Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor may allow Taking Ownership Over Devices

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-03-19 14:35 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

2 references

URL	Tags
https://www.gov.il/en/departments/dynamiccollecto…
https://claroty.com/team82/blog/new-critical-vuln…

Impacted products

2 products

Vendor	Product	Version
Unitronics	Unistream Unilogic	Affected: All versions , < 1.35.227 (custom)
unitronics	unistream_unilogic	Affected: 0 , < 1.35.227 (custom) cpe:2.3:a:unitronics:unistream_unilogic::::::::

Date Public

2024-03-18 14:00

Credits

Noam Moshe, Vera Mens of Claroty Team82

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:unitronics:unistream_unilogic:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "unistream_unilogic",
            "vendor": "unitronics",
            "versions": [
              {
                "lessThan": "1.35.227",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27769",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-19T14:35:02.996286Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-10T20:24:59.561Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:41:54.428Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unistream Unilogic",
          "vendor": "Unitronics ",
          "versions": [
            {
              "lessThan": "1.35.227",
              "status": "affected",
              "version": "All versions",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Noam Moshe, Vera Mens of Claroty Team82"
        }
      ],
      "datePublic": "2024-03-18T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 - \n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eCWE-200: Exposure of Sensitive Information to an Unauthorized Actor may allow Taking Ownership Over Devices\u003c/span\u003e\n\n\u003c/span\u003e\n\n\u003c/span\u003e\n\n"
            }
          ],
          "value": "\nUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 - \n\nCWE-200: Exposure of Sensitive Information to an Unauthorized Actor may allow Taking Ownership Over Devices\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-18T13:21:17.800Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
        },
        {
          "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUpgrade to version 1.35.227 or later.\u003c/span\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "\nUpgrade to version 1.35.227 or later.\n\n"
        }
      ],
      "source": {
        "advisory": "ILVN-2024-0149",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics Unistream Unilogic \u2013 Versions prior to 1.35.227  CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2024-27769",
    "datePublished": "2024-03-18T13:21:17.800Z",
    "dateReserved": "2024-02-26T09:27:55.322Z",
    "dateUpdated": "2025-04-10T20:24:59.561Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-27768 (GCVE-0-2024-27768)

Vulnerability from nvd – Published: 2024-03-18 13:19 – Updated: 2024-08-02 00:41

Title

Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-22: 'Path Traversal'

Summary

Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-22: 'Path Traversal' may allow RCE

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-03-18 18:20 UTC

CWE

CWE-22 - 'Path Traversal'

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

2 references

URL	Tags
https://www.gov.il/en/departments/dynamiccollecto…
https://claroty.com/team82/blog/new-critical-vuln…

Impacted products

2 products

Vendor	Product	Version
Unitronics	Unistream Unilogic	Affected: All versions , < 1.35.227 (custom)
unitronics	unistream_unilogic	Affected: 0 , < 1.35.227 (custom) cpe:2.3:a:unitronics:unistream_unilogic::::::::

Date Public

2024-03-18 14:00

Credits

Noam Moshe, Vera Mens of Claroty Team82

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:unitronics:unistream_unilogic:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "unistream_unilogic",
            "vendor": "unitronics",
            "versions": [
              {
                "lessThan": "1.35.227",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27768",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-18T18:20:07.973933Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-20T21:26:07.259Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:41:54.285Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unistream Unilogic",
          "vendor": "Unitronics ",
          "versions": [
            {
              "lessThan": "1.35.227",
              "status": "affected",
              "version": "All versions",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Noam Moshe, Vera Mens of Claroty Team82"
        }
      ],
      "datePublic": "2024-03-18T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 - CWE-22: \u0027Path Traversal\u0027 may allow RCE\u003c/span\u003e\n\n\u003c/span\u003e\n\n"
            }
          ],
          "value": "\nUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 - CWE-22: \u0027Path Traversal\u0027 may allow RCE\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: \u0027Path Traversal\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-18T13:19:49.735Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
        },
        {
          "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUpgrade to version 1.35.227 or later.\u003c/span\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "\nUpgrade to version 1.35.227 or later.\n\n"
        }
      ],
      "source": {
        "advisory": "ILVN-2024-0148",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics Unistream Unilogic \u2013 Versions prior to 1.35.227  CWE-22: \u0027Path Traversal\u0027",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2024-27768",
    "datePublished": "2024-03-18T13:19:49.735Z",
    "dateReserved": "2024-02-26T09:27:55.322Z",
    "dateUpdated": "2024-08-02T00:41:54.285Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-27767 (GCVE-0-2024-27767)

Vulnerability from nvd – Published: 2024-03-18 13:13 – Updated: 2024-08-02 00:41

Title

Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-287: Improper Authentication

Summary

CWE-287: Improper Authentication may allow Authentication Bypass

Severity

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-03-18 18:22 UTC

CWE

CWE-287 - Improper Authentication

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

1 reference

URL	Tags
https://www.gov.il/en/departments/dynamiccollecto…

Impacted products

2 products

Vendor	Product	Version
Unitronics	Unistream Unilogic	Affected: All versions , < 1.35.227 (custom)
unitronics	unistream_unilogic	Affected: 0 , < 1.35.227 (custom) cpe:2.3:a:unitronics:unistream_unilogic::::::::

Date Public

2024-03-18 14:00

Credits

Noam Moshe, Vera Mens of Claroty Team82

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:unitronics:unistream_unilogic:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "unistream_unilogic",
            "vendor": "unitronics",
            "versions": [
              {
                "lessThan": "1.35.227",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27767",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-18T18:22:57.969128Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-20T21:26:31.866Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:41:54.434Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unistream Unilogic",
          "vendor": "Unitronics ",
          "versions": [
            {
              "lessThan": "1.35.227",
              "status": "affected",
              "version": "All versions",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Noam Moshe, Vera Mens of Claroty Team82"
        }
      ],
      "datePublic": "2024-03-18T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eCWE-287: Improper Authentication may allow Authentication Bypass\u003c/span\u003e\n\n"
            }
          ],
          "value": "\nCWE-287: Improper Authentication may allow Authentication Bypass\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-18T13:13:36.868Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUpgrade to version 1.35.227 or later.\u003c/span\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "\nUpgrade to version 1.35.227 or later.\n\n"
        }
      ],
      "source": {
        "advisory": "ILVN-2024-0147",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics Unistream Unilogic \u2013 Versions prior to 1.35.227  CWE-287: Improper Authentication",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2024-27767",
    "datePublished": "2024-03-18T13:13:36.868Z",
    "dateReserved": "2024-02-26T09:27:55.322Z",
    "dateUpdated": "2024-08-02T00:41:54.434Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-45452 (GCVE-0-2026-45452)

Vulnerability from cvelistv5 – Published: 2026-10-15 15:25 – Updated: 2026-10-15 17:59

Title

Unitronics - CWE-134 Use of Externally-Controlled format string

Summary

Use of Externally-Controlled format string vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.

Severity

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 17:58 UTC

CWE

CWE-134 - Use of Externally-Controlled format string

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

1 reference

URL	Tags
https://www.gov.il/en/departments/dynamiccollecto…

Impacted products

1 product

Vendor	Product	Version
Unitronics	Unitronics UniStream Pro/UniLogic	Affected: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329

Date Public

2026-10-15 15:13

Credits

SemanticGuard

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45452",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T17:58:47.636535Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T17:59:46.210Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unitronics UniStream Pro/UniLogic",
          "vendor": "Unitronics",
          "versions": [
            {
              "status": "affected",
              "version": "Unitronics UniStream Pro versions only (B10 / C10) \u2013 UniLogic versions prior to 1.41.329"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SemanticGuard"
        }
      ],
      "datePublic": "2026-10-15T15:13:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use of Externally-Controlled format string vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.\u003cp\u003eThis issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) \u2013 UniLogic versions prior to 1.41.329.\u003c/p\u003e"
            }
          ],
          "value": "Use of Externally-Controlled format string vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.\n\nThis issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) \u2013 UniLogic versions prior to 1.41.329."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-134",
              "description": "CWE-134 Use of Externally-Controlled format string",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T15:25:54.445Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003ctable\u003e\n \n \u003ctbody\u003e\u003ctr\u003e\n\n  \u003ctd\u003e\u003ctable\u003e\n \n \u003ctbody\u003e\u003ctr\u003e\n\n  \u003ctd\u003eUpgrade UniLogic and UniStream to version 1.42.220 or above\u003c/td\u003e\n\n \u003c/tr\u003e\n\u003c/tbody\u003e\u003c/table\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
            }
          ],
          "value": "Upgrade UniLogic and UniStream to version 1.42.220 or above"
        }
      ],
      "source": {
        "advisory": "ILVN-2025-0264",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics - CWE-134 Use of Externally-Controlled format string",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2026-45452",
    "datePublished": "2026-10-15T15:25:54.445Z",
    "dateReserved": "2026-05-12T15:11:23.921Z",
    "dateUpdated": "2026-10-15T17:59:46.210Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-45451 (GCVE-0-2026-45451)

Vulnerability from cvelistv5 – Published: 2026-10-15 15:23 – Updated: 2026-10-15 18:00

Title

Unitronics - CWE-287: Improper Authentication

Summary

: Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.

Severity

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 18:00 UTC

CWE

CWE-287 - Improper Authentication

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

1 reference

URL	Tags
https://www.gov.il/en/departments/dynamiccollecto…

Impacted products

1 product

Vendor	Product	Version
Unitronics	Unitronics UniStream Pro/UniLogic	Affected: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329

Date Public

2026-10-15 15:13

Credits

SemanticGuard

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45451",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T18:00:17.370132Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T18:00:27.448Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unitronics UniStream Pro/UniLogic",
          "vendor": "Unitronics",
          "versions": [
            {
              "status": "affected",
              "version": "Unitronics UniStream Pro versions only (B10 / C10) \u2013 UniLogic versions prior to 1.41.329"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SemanticGuard"
        }
      ],
      "datePublic": "2026-10-15T15:13:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": ": Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.\u003cp\u003eThis issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) \u2013 UniLogic versions prior to 1.41.329.\u003c/p\u003e"
            }
          ],
          "value": ": Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.\n\nThis issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) \u2013 UniLogic versions prior to 1.41.329."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T15:23:55.464Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003ctable\u003e\n \n \u003ctbody\u003e\u003ctr\u003e\n\n  \u003ctd\u003e\u003ctable\u003e\n \n \u003ctbody\u003e\u003ctr\u003e\n\n  \u003ctd\u003eUpgrade UniLogic and UniStream to version 1.42.220 or above\u003c/td\u003e\n\n \u003c/tr\u003e\n\u003c/tbody\u003e\u003c/table\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
            }
          ],
          "value": "Upgrade UniLogic and UniStream to version 1.42.220 or above"
        }
      ],
      "source": {
        "advisory": "ILVN-2025-0263",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics - CWE-287: Improper Authentication",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2026-45451",
    "datePublished": "2026-10-15T15:23:55.464Z",
    "dateReserved": "2026-05-12T15:11:23.921Z",
    "dateUpdated": "2026-10-15T18:00:27.448Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-45450 (GCVE-0-2026-45450)

Vulnerability from cvelistv5 – Published: 2026-10-15 15:21 – Updated: 2026-10-15 18:01

Title

Unitronics - CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

Summary

: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.

Severity

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 18:00 UTC

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

1 reference

URL	Tags
https://www.gov.il/en/departments/dynamiccollecto…

Impacted products

1 product

Vendor	Product	Version
Unitronics	Unitronics UniStream Pro/UniLogic	Affected: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329

Date Public

2026-10-15 15:13

Credits

SemanticGuard

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45450",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T18:00:51.546802Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T18:01:17.303Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unitronics UniStream Pro/UniLogic",
          "vendor": "Unitronics",
          "versions": [
            {
              "status": "affected",
              "version": "Unitronics UniStream Pro versions only (B10 / C10) \u2013 UniLogic versions prior to 1.41.329"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SemanticGuard"
        }
      ],
      "datePublic": "2026-10-15T15:13:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": ": Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.\u003cp\u003eThis issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) \u2013 UniLogic versions prior to 1.41.329.\u003c/p\u003e"
            }
          ],
          "value": ": Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.\n\nThis issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) \u2013 UniLogic versions prior to 1.41.329."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T15:21:41.203Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003ctable\u003e\n \n \u003ctbody\u003e\u003ctr\u003e\n\n  \u003ctd\u003e\u003ctable\u003e\n \n \u003ctbody\u003e\u003ctr\u003e\n\n  \u003ctd\u003eUpgrade UniLogic and UniStream to version 1.42.220 or above\u003c/td\u003e\n\n \u003c/tr\u003e\n\u003c/tbody\u003e\u003c/table\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
            }
          ],
          "value": "Upgrade UniLogic and UniStream to version 1.42.220 or above"
        }
      ],
      "source": {
        "advisory": "ILVN-2025-0262",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics - CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2026-45450",
    "datePublished": "2026-10-15T15:21:41.203Z",
    "dateReserved": "2026-05-12T15:11:23.921Z",
    "dateUpdated": "2026-10-15T18:01:17.303Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-45449 (GCVE-0-2026-45449)

Vulnerability from cvelistv5 – Published: 2026-10-15 15:18 – Updated: 2026-10-15 18:06

Title

Unitronics - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Summary

: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.

Severity

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 18:05 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

1 reference

URL	Tags
https://www.gov.il/en/departments/dynamiccollecto…

Impacted products

1 product

Vendor	Product	Version
Unitronics	Unitronics UniStream Pro/UniLogic	Affected: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329

Date Public

2026-10-15 15:13

Credits

SemanticGuard

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45449",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T18:05:49.669716Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T18:06:03.223Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unitronics UniStream Pro/UniLogic",
          "vendor": "Unitronics",
          "versions": [
            {
              "status": "affected",
              "version": "Unitronics UniStream Pro versions only (B10 / C10) \u2013 UniLogic versions prior to 1.41.329"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SemanticGuard"
        }
      ],
      "datePublic": "2026-10-15T15:13:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": ": Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.\u003cp\u003eThis issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) \u2013 UniLogic versions prior to 1.41.329.\u003c/p\u003e"
            }
          ],
          "value": ": Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) vulnerability in Unitronics Unitronics UniStream Pro/UniLogic.\n\nThis issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) \u2013 UniLogic versions prior to 1.41.329."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T15:18:59.438Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003ctable\u003e\n \n \u003ctbody\u003e\u003ctr\u003e\n\n  \u003ctd\u003eUpgrade UniLogic and UniStream to version 1.41.329 or above\u003c/td\u003e\n\n \u003c/tr\u003e\n\u003c/tbody\u003e\u003c/table\u003e"
            }
          ],
          "value": "Upgrade UniLogic and UniStream to version 1.41.329 or above"
        }
      ],
      "source": {
        "advisory": "ILVN-2025-0261",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics - CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2026-45449",
    "datePublished": "2026-10-15T15:18:59.438Z",
    "dateReserved": "2026-05-12T15:11:23.921Z",
    "dateUpdated": "2026-10-15T18:06:03.223Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-38435 (GCVE-0-2024-38435)

Vulnerability from cvelistv5 – Published: 2024-07-21 07:10 – Updated: 2024-08-02 04:12

Title

Unitronics Vision PLC - CWE-703: Improper Check or Handling of Exceptional Conditions

Summary

Unitronics Vision PLC – CWE-703: Improper Check or Handling of Exceptional Conditions may allow denial of service

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-07-22 11:51 UTC

CWE

CWE-703 - Improper Check or Handling of Exceptional Conditions

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

1 reference

URL	Tags
https://www.gov.il/en/Departments/faq/cve_advisories

Impacted products

1 product

Vendor	Product	Version
Unitronics	Vision PLC	Affected: All versions , < Upgrade to v9.9.1 (custom)

Date Public

2024-07-18 07:05

Credits

Claroty Research – Team 82

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38435",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-22T11:51:46.970559Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-22T11:51:57.805Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:12:24.743Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.gov.il/en/Departments/faq/cve_advisories"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Vision PLC",
          "vendor": "Unitronics",
          "versions": [
            {
              "lessThan": "Upgrade to v9.9.1",
              "status": "affected",
              "version": "All versions",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Claroty Research \u2013 Team 82"
        }
      ],
      "datePublic": "2024-07-18T07:05:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUnitronics Vision PLC \u2013\u0026nbsp;\u003c/span\u003eCWE-703: Improper Check or Handling of Exceptional Conditions may allow denial of service\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cp\u003e\u0026nbsp;\u003c/p\u003e\n\n\u003c/span\u003e"
            }
          ],
          "value": "Unitronics Vision PLC \u2013\u00a0CWE-703: Improper Check or Handling of Exceptional Conditions may allow denial of service"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-703",
              "description": "CWE-703: Improper Check or Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-21T07:10:04.460Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/Departments/faq/cve_advisories"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUpgrade to v9.9.1\u003c/span\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Upgrade to v9.9.1"
        }
      ],
      "source": {
        "advisory": "ILVN-2024-0173",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics Vision PLC - CWE-703: Improper Check or Handling of Exceptional Conditions",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2024-38435",
    "datePublished": "2024-07-21T07:10:04.460Z",
    "dateReserved": "2024-06-16T08:00:52.286Z",
    "dateUpdated": "2024-08-02T04:12:24.743Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-38434 (GCVE-0-2024-38434)

Vulnerability from cvelistv5 – Published: 2024-07-21 07:08 – Updated: 2024-08-02 04:12

Title

Unitronics Vision PLC - CWE-676: Use of Potentially Dangerous Function

Summary

Unitronics Vision PLC – CWE-676: Use of Potentially Dangerous Function may allow security feature bypass

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-07-29 14:56 UTC

CWE

CWE-676 - Use of Potentially Dangerous Function

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

1 reference

URL	Tags
https://www.gov.il/en/Departments/faq/cve_advisories

Impacted products

1 product

Vendor	Product	Version
Unitronics	Vision PLC	Affected: All versions , < Upgrade to v9.9.1 (custom)

Date Public

2024-07-18 07:05

Credits

Claroty Research – Team 82

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38434",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-29T14:56:41.036778Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-29T14:56:57.915Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:12:24.698Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.gov.il/en/Departments/faq/cve_advisories"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Vision PLC",
          "vendor": "Unitronics",
          "versions": [
            {
              "lessThan": "Upgrade to v9.9.1",
              "status": "affected",
              "version": "All versions",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Claroty Research \u2013 Team 82"
        }
      ],
      "datePublic": "2024-07-18T07:05:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUnitronics Vision PLC \u2013  \n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eCWE-676: Use of Potentially Dangerous Function\u003c/span\u003e\u003cb\u003e\u0026nbsp;\u003c/b\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003emay allow security feature bypass\u003c/span\u003e\n\n\u003c/span\u003e"
            }
          ],
          "value": "Unitronics Vision PLC \u2013  \n\nCWE-676: Use of Potentially Dangerous Function\u00a0may allow security feature bypass"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-676",
              "description": "CWE-676: Use of Potentially Dangerous Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-21T07:08:52.056Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/Departments/faq/cve_advisories"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUpgrade to v9.9.1\u003c/span\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Upgrade to v9.9.1"
        }
      ],
      "source": {
        "advisory": "ILVN-2024-0172",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics Vision PLC - CWE-676: Use of Potentially Dangerous Function",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2024-38434",
    "datePublished": "2024-07-21T07:08:52.056Z",
    "dateReserved": "2024-06-16T08:00:52.285Z",
    "dateUpdated": "2024-08-02T04:12:24.698Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-1480 (GCVE-0-2024-1480)

Vulnerability from cvelistv5 – Published: 2024-04-19 21:19 – Updated: 2024-08-01 18:40

Title

Unitronics Vision Standard Unauthenticated Password Retrieval

Summary

Unitronics Vision Standard line of controllers allow the Information Mode password to be retrieved without authentication.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-04-20 19:55 UTC

CWE

CWE-257 - Storing Passwords in a Recoverable Format

Assigner

Dragos CNA under the icscert root

CNA scorecard – unranked: 0 records in the last 180 days, 10 needed details

References

2 references

URL	Tags
https://www.cisa.gov/news-events/ics-advisories/i…
https://www.dragos.com/advisory/unitronics-vision…

Impacted products

5 products

Vendor	Product	Version
Unitronics	Vision230	Affected: 0
Unitronics	Vision280	Affected: 0
Unitronics	Vision290	Affected: 0
Unitronics	Vision530	Affected: 0
Unitronics	Vision120	Affected: 0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-1480",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-20T19:55:11.495288Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-23T18:46:06.919Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:40:21.234Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-109-01"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.dragos.com/advisory/unitronics-vision-standard/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Vision230",
          "vendor": "Unitronics",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Vision280",
          "vendor": "Unitronics",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Vision290",
          "vendor": "Unitronics",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Vision530",
          "vendor": "Unitronics",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Vision120",
          "vendor": "Unitronics",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unitronics Vision Standard line of controllers allow the Information Mode password to be retrieved without authentication."
            }
          ],
          "value": "Unitronics Vision Standard line of controllers allow the Information Mode password to be retrieved without authentication."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-114",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-114 Authentication Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-257",
              "description": "CWE-257 Storing Passwords in a Recoverable Format",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-19T21:19:27.592Z",
        "orgId": "12bdf821-1545-4a87-aac5-61670cc6fcef",
        "shortName": "Dragos"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-109-01"
        },
        {
          "url": "https://www.dragos.com/advisory/unitronics-vision-standard/"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Unitronics Vision Standard Unauthenticated Password Retrieval",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "12bdf821-1545-4a87-aac5-61670cc6fcef",
    "assignerShortName": "Dragos",
    "cveId": "CVE-2024-1480",
    "datePublished": "2024-04-19T21:19:27.592Z",
    "dateReserved": "2024-02-13T18:49:36.966Z",
    "dateUpdated": "2024-08-01T18:40:21.234Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-27774 (GCVE-0-2024-27774)

Vulnerability from cvelistv5 – Published: 2024-03-18 13:34 – Updated: 2024-08-02 00:41

Title

Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-259: Use of Hard-coded Password

Summary

Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-259: Use of Hard-coded Password may allow disclosing Sensitive Information Embedded inside Device's Firmware

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-20 21:32 UTC

CWE

CWE-259 - Use of Hard-coded Password

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

2 references

URL	Tags
https://www.gov.il/en/departments/dynamiccollecto…
https://claroty.com/team82/blog/new-critical-vuln…

Impacted products

2 products

Vendor	Product	Version
Unitronics	Unistream Unilogic	Affected: All versions , < 1.35.227 (custom)
unitronics	unistream_unilogic	Affected: 0 , < 1.35.227 (custom) cpe:2.3:a:unitronics:unistream_unilogic::::::::

Date Public

2024-03-18 14:00

Credits

Noam Moshe, Vera Mens of Claroty Team82

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:unitronics:unistream_unilogic:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "unistream_unilogic",
            "vendor": "unitronics",
            "versions": [
              {
                "lessThan": "1.35.227",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27774",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-20T21:32:07.422871Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-20T21:32:26.836Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:41:54.444Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unistream Unilogic",
          "vendor": "Unitronics ",
          "versions": [
            {
              "lessThan": "1.35.227",
              "status": "affected",
              "version": "All versions",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Noam Moshe, Vera Mens of Claroty Team82"
        }
      ],
      "datePublic": "2024-03-18T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 -\n\n\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eCWE-259: Use of Hard-coded Password may allow disclosing Sensitive Information Embedded inside Device\u0027s Firmware\u003c/span\u003e\n\n\u003c/span\u003e\n\n\u003c/span\u003e\n\n\n\n\n\n\n\n\u003c/span\u003e\n\n\u003c/span\u003e\n\n"
            }
          ],
          "value": "\nUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 -\n\nCWE-259: Use of Hard-coded Password may allow disclosing Sensitive Information Embedded inside Device\u0027s Firmware\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-259",
              "description": "CWE-259: Use of Hard-coded Password",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-18T13:34:31.538Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
        },
        {
          "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUpgrade to version 1.35.227 or later.\u003c/span\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "\nUpgrade to version 1.35.227 or later.\n\n"
        }
      ],
      "source": {
        "advisory": "ILVN-2024-0154",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics Unistream Unilogic \u2013 Versions prior to 1.35.227  CWE-259: Use of Hard-coded Password",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2024-27774",
    "datePublished": "2024-03-18T13:34:31.538Z",
    "dateReserved": "2024-02-26T09:27:55.323Z",
    "dateUpdated": "2024-08-02T00:41:54.444Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-27773 (GCVE-0-2024-27773)

Vulnerability from cvelistv5 – Published: 2024-03-18 13:32 – Updated: 2024-08-02 00:41

Title

Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-348: Use of Less Trusted Source

Summary

Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-348: Use of Less Trusted Source may allow RCE

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-03-21 15:33 UTC

CWE

CWE-348 - Use of Less Trusted Source

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

2 references

URL	Tags
https://www.gov.il/en/departments/dynamiccollecto…
https://claroty.com/team82/blog/new-critical-vuln…

Impacted products

2 products

Vendor	Product	Version
Unitronics	Unistream Unilogic	Affected: All versions , < 1.35.227 (custom)
unitronics	unistream_unilogic	Affected: 0 , < 1.35.227 (custom) cpe:2.3:a:unitronics:unistream_unilogic::::::::

Date Public

2024-03-18 14:00

Credits

Noam Moshe, Vera Mens of Claroty Team82

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:unitronics:unistream_unilogic:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "unistream_unilogic",
            "vendor": "unitronics",
            "versions": [
              {
                "lessThan": "1.35.227",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27773",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-21T15:33:05.323875Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-20T21:27:28.047Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:41:54.422Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unistream Unilogic",
          "vendor": "Unitronics ",
          "versions": [
            {
              "lessThan": "1.35.227",
              "status": "affected",
              "version": "All versions",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Noam Moshe, Vera Mens of Claroty Team82"
        }
      ],
      "datePublic": "2024-03-18T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 -\n\n\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eCWE-348: Use of Less Trusted Source may allow RCE\u003c/span\u003e\n\n\u003c/span\u003e\n\n\n\n\n\n\n\n\u003c/span\u003e\n\n\u003c/span\u003e\n\n"
            }
          ],
          "value": "\nUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 -\n\nCWE-348: Use of Less Trusted Source may allow RCE\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-348",
              "description": "CWE-348: Use of Less Trusted Source",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-18T13:32:46.698Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
        },
        {
          "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUpgrade to version 1.35.227 or later.\u003c/span\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "\nUpgrade to version 1.35.227 or later.\n\n"
        }
      ],
      "source": {
        "advisory": "ILVN-2024-0153",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics Unistream Unilogic \u2013 Versions prior to 1.35.227  CWE-348: Use of Less Trusted Source",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2024-27773",
    "datePublished": "2024-03-18T13:32:46.698Z",
    "dateReserved": "2024-02-26T09:27:55.323Z",
    "dateUpdated": "2024-08-02T00:41:54.422Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-27772 (GCVE-0-2024-27772)

Vulnerability from cvelistv5 – Published: 2024-03-18 13:28 – Updated: 2024-08-02 00:41

Title

Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-78: 'OS Command Injection'

Summary

Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-78: 'OS Command Injection' may allow RCE

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-03-18 18:06 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

2 references

URL	Tags
https://www.gov.il/en/departments/dynamiccollecto…
https://claroty.com/team82/blog/new-critical-vuln…

Impacted products

2 products

Vendor	Product	Version
Unitronics	Unistream Unilogic	Affected: All versions , < 1.35.227 (custom)
unitronics	unistream_unilogic	Affected: 0 , < 1.35.227 (custom) cpe:2.3:a:unitronics:unistream_unilogic::::::::

Date Public

2024-03-18 14:00

Credits

Noam Moshe, Vera Mens of Claroty Team82

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:unitronics:unistream_unilogic:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "unistream_unilogic",
            "vendor": "unitronics",
            "versions": [
              {
                "lessThan": "1.35.227",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27772",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-18T18:06:12.435070Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-20T21:22:58.597Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:41:54.441Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unistream Unilogic",
          "vendor": "Unitronics ",
          "versions": [
            {
              "lessThan": "1.35.227",
              "status": "affected",
              "version": "All versions",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Noam Moshe, Vera Mens of Claroty Team82"
        }
      ],
      "datePublic": "2024-03-18T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 -\n\n\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eCWE-78: \u0027OS Command Injection\u0027 may allow RCE\u003c/span\u003e\n\n\n\n\n\n\n\n\u003c/span\u003e\n\n\u003c/span\u003e\n\n"
            }
          ],
          "value": "\nUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 -\n\nCWE-78: \u0027OS Command Injection\u0027 may allow RCE\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-18T13:28:35.731Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
        },
        {
          "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUpgrade to version 1.35.227 or later.\u003c/span\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "\nUpgrade to version 1.35.227 or later.\n\n"
        }
      ],
      "source": {
        "advisory": "ILVN-2024-0152",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics Unistream Unilogic \u2013 Versions prior to 1.35.227  CWE-78: \u0027OS Command Injection\u0027",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2024-27772",
    "datePublished": "2024-03-18T13:28:35.731Z",
    "dateReserved": "2024-02-26T09:27:55.323Z",
    "dateUpdated": "2024-08-02T00:41:54.441Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-27771 (GCVE-0-2024-27771)

Vulnerability from cvelistv5 – Published: 2024-03-18 13:27 – Updated: 2024-08-02 00:41

Title

Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-22: 'Path Traversal'

Summary

Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-22: 'Path Traversal' may allow RCE

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-03-18 18:20 UTC

CWE

CWE-22 - 'Path Traversal'

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

2 references

URL	Tags
https://www.gov.il/en/departments/dynamiccollecto…
https://claroty.com/team82/blog/new-critical-vuln…

Impacted products

2 products

Vendor	Product	Version
Unitronics	Unistream Unilogic	Affected: All versions , < 1.35.227 (custom)
unitronics	unistream_unilogic	Affected: 0 , < 1.35.227 (custom) cpe:2.3:a:unitronics:unistream_unilogic::::::::

Date Public

2024-03-18 14:00

Credits

Noam Moshe, Vera Mens of Claroty Team82

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:unitronics:unistream_unilogic:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "unistream_unilogic",
            "vendor": "unitronics",
            "versions": [
              {
                "lessThan": "1.35.227",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27771",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-18T18:20:07.973933Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-20T21:24:27.361Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:41:54.438Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unistream Unilogic",
          "vendor": "Unitronics ",
          "versions": [
            {
              "lessThan": "1.35.227",
              "status": "affected",
              "version": "All versions",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Noam Moshe, Vera Mens of Claroty Team82"
        }
      ],
      "datePublic": "2024-03-18T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 -\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eCWE-22: \u0027Path Traversal\u0027\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;may allow RCE\u003c/span\u003e\n\n\n\n\n\n\u003c/span\u003e\n\n\u003c/span\u003e\n\n"
            }
          ],
          "value": "\nUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 -\n\nCWE-22: \u0027Path Traversal\u0027\u00a0may allow RCE\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: \u0027Path Traversal\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-18T13:27:39.449Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
        },
        {
          "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUpgrade to version 1.35.227 or later.\u003c/span\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "\nUpgrade to version 1.35.227 or later.\n\n"
        }
      ],
      "source": {
        "advisory": "ILVN-2024-0151",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics Unistream Unilogic \u2013 Versions prior to 1.35.227  CWE-22: \u0027Path Traversal\u0027",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2024-27771",
    "datePublished": "2024-03-18T13:27:39.449Z",
    "dateReserved": "2024-02-26T09:27:55.323Z",
    "dateUpdated": "2024-08-02T00:41:54.438Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-27770 (GCVE-0-2024-27770)

Vulnerability from cvelistv5 – Published: 2024-03-18 13:23 – Updated: 2024-08-02 00:41

Title

Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-23: Relative Path Traversal

Summary

Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-23: Relative Path Traversal

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-03-18 18:20 UTC

CWE

CWE-23 - Relative Path Traversal

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

2 references

URL	Tags
https://www.gov.il/en/departments/dynamiccollecto…
https://claroty.com/team82/blog/new-critical-vuln…

Impacted products

2 products

Vendor	Product	Version
Unitronics	Unistream Unilogic	Affected: All versions , < 1.35.227 (custom)
unitronics	unistream_unilogic	Affected: 0 , < 1.35.227 (custom) cpe:2.3:a:unitronics:unistream_unilogic::::::::

Date Public

2024-03-18 14:00

Credits

Noam Moshe, Vera Mens of Claroty Team82

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:unitronics:unistream_unilogic:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "unistream_unilogic",
            "vendor": "unitronics",
            "versions": [
              {
                "lessThan": "1.35.227",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27770",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-18T18:20:07.973933Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-20T21:25:03.972Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:41:54.287Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unistream Unilogic",
          "vendor": "Unitronics ",
          "versions": [
            {
              "lessThan": "1.35.227",
              "status": "affected",
              "version": "All versions",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Noam Moshe, Vera Mens of Claroty Team82"
        }
      ],
      "datePublic": "2024-03-18T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 - \n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eCWE-23: Relative Path Traversal\u003c/span\u003e\n\n\u003c/span\u003e\n\n\u003c/span\u003e\n\n\u003c/span\u003e\n\n"
            }
          ],
          "value": "\nUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 - \n\nCWE-23: Relative Path Traversal\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "CWE-23: Relative Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-18T13:23:31.838Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
        },
        {
          "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUpgrade to version 1.35.227 or later.\u003c/span\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "\nUpgrade to version 1.35.227 or later.\n\n"
        }
      ],
      "source": {
        "advisory": "ILVN-2024-0150",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics Unistream Unilogic \u2013 Versions prior to 1.35.227  CWE-23: Relative Path Traversal",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2024-27770",
    "datePublished": "2024-03-18T13:23:31.838Z",
    "dateReserved": "2024-02-26T09:27:55.323Z",
    "dateUpdated": "2024-08-02T00:41:54.287Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-27769 (GCVE-0-2024-27769)

Vulnerability from cvelistv5 – Published: 2024-03-18 13:21 – Updated: 2025-04-10 20:24

Title

Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Summary

Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor may allow Taking Ownership Over Devices

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-03-19 14:35 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

2 references

URL	Tags
https://www.gov.il/en/departments/dynamiccollecto…
https://claroty.com/team82/blog/new-critical-vuln…

Impacted products

2 products

Vendor	Product	Version
Unitronics	Unistream Unilogic	Affected: All versions , < 1.35.227 (custom)
unitronics	unistream_unilogic	Affected: 0 , < 1.35.227 (custom) cpe:2.3:a:unitronics:unistream_unilogic::::::::

Date Public

2024-03-18 14:00

Credits

Noam Moshe, Vera Mens of Claroty Team82

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:unitronics:unistream_unilogic:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "unistream_unilogic",
            "vendor": "unitronics",
            "versions": [
              {
                "lessThan": "1.35.227",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27769",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-19T14:35:02.996286Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-10T20:24:59.561Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:41:54.428Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unistream Unilogic",
          "vendor": "Unitronics ",
          "versions": [
            {
              "lessThan": "1.35.227",
              "status": "affected",
              "version": "All versions",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Noam Moshe, Vera Mens of Claroty Team82"
        }
      ],
      "datePublic": "2024-03-18T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 - \n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eCWE-200: Exposure of Sensitive Information to an Unauthorized Actor may allow Taking Ownership Over Devices\u003c/span\u003e\n\n\u003c/span\u003e\n\n\u003c/span\u003e\n\n"
            }
          ],
          "value": "\nUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 - \n\nCWE-200: Exposure of Sensitive Information to an Unauthorized Actor may allow Taking Ownership Over Devices\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-18T13:21:17.800Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
        },
        {
          "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUpgrade to version 1.35.227 or later.\u003c/span\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "\nUpgrade to version 1.35.227 or later.\n\n"
        }
      ],
      "source": {
        "advisory": "ILVN-2024-0149",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics Unistream Unilogic \u2013 Versions prior to 1.35.227  CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2024-27769",
    "datePublished": "2024-03-18T13:21:17.800Z",
    "dateReserved": "2024-02-26T09:27:55.322Z",
    "dateUpdated": "2025-04-10T20:24:59.561Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-27768 (GCVE-0-2024-27768)

Vulnerability from cvelistv5 – Published: 2024-03-18 13:19 – Updated: 2024-08-02 00:41

Title

Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-22: 'Path Traversal'

Summary

Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-22: 'Path Traversal' may allow RCE

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-03-18 18:20 UTC

CWE

CWE-22 - 'Path Traversal'

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

2 references

URL	Tags
https://www.gov.il/en/departments/dynamiccollecto…
https://claroty.com/team82/blog/new-critical-vuln…

Impacted products

2 products

Vendor	Product	Version
Unitronics	Unistream Unilogic	Affected: All versions , < 1.35.227 (custom)
unitronics	unistream_unilogic	Affected: 0 , < 1.35.227 (custom) cpe:2.3:a:unitronics:unistream_unilogic::::::::

Date Public

2024-03-18 14:00

Credits

Noam Moshe, Vera Mens of Claroty Team82

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:unitronics:unistream_unilogic:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "unistream_unilogic",
            "vendor": "unitronics",
            "versions": [
              {
                "lessThan": "1.35.227",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27768",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-18T18:20:07.973933Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-20T21:26:07.259Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:41:54.285Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unistream Unilogic",
          "vendor": "Unitronics ",
          "versions": [
            {
              "lessThan": "1.35.227",
              "status": "affected",
              "version": "All versions",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Noam Moshe, Vera Mens of Claroty Team82"
        }
      ],
      "datePublic": "2024-03-18T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 - CWE-22: \u0027Path Traversal\u0027 may allow RCE\u003c/span\u003e\n\n\u003c/span\u003e\n\n"
            }
          ],
          "value": "\nUnitronics Unistream Unilogic \u2013 Versions prior to 1.35.227 - CWE-22: \u0027Path Traversal\u0027 may allow RCE\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: \u0027Path Traversal\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-18T13:19:49.735Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
        },
        {
          "url": "https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUpgrade to version 1.35.227 or later.\u003c/span\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "\nUpgrade to version 1.35.227 or later.\n\n"
        }
      ],
      "source": {
        "advisory": "ILVN-2024-0148",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics Unistream Unilogic \u2013 Versions prior to 1.35.227  CWE-22: \u0027Path Traversal\u0027",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2024-27768",
    "datePublished": "2024-03-18T13:19:49.735Z",
    "dateReserved": "2024-02-26T09:27:55.322Z",
    "dateUpdated": "2024-08-02T00:41:54.285Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-27767 (GCVE-0-2024-27767)

Vulnerability from cvelistv5 – Published: 2024-03-18 13:13 – Updated: 2024-08-02 00:41

Title

Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-287: Improper Authentication

Summary

CWE-287: Improper Authentication may allow Authentication Bypass

Severity

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-03-18 18:22 UTC

CWE

CWE-287 - Improper Authentication

Assigner

INCD CNA under the mitre root

CNA scorecard C 69/100 over 17 records in the last 180 days details

References

1 reference

URL	Tags
https://www.gov.il/en/departments/dynamiccollecto…

Impacted products

2 products

Vendor	Product	Version
Unitronics	Unistream Unilogic	Affected: All versions , < 1.35.227 (custom)
unitronics	unistream_unilogic	Affected: 0 , < 1.35.227 (custom) cpe:2.3:a:unitronics:unistream_unilogic::::::::

Date Public

2024-03-18 14:00

Credits

Noam Moshe, Vera Mens of Claroty Team82

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:unitronics:unistream_unilogic:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "unistream_unilogic",
            "vendor": "unitronics",
            "versions": [
              {
                "lessThan": "1.35.227",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27767",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-18T18:22:57.969128Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-20T21:26:31.866Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:41:54.434Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unistream Unilogic",
          "vendor": "Unitronics ",
          "versions": [
            {
              "lessThan": "1.35.227",
              "status": "affected",
              "version": "All versions",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Noam Moshe, Vera Mens of Claroty Team82"
        }
      ],
      "datePublic": "2024-03-18T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eCWE-287: Improper Authentication may allow Authentication Bypass\u003c/span\u003e\n\n"
            }
          ],
          "value": "\nCWE-287: Improper Authentication may allow Authentication Bypass\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-18T13:13:36.868Z",
        "orgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
        "shortName": "INCD"
      },
      "references": [
        {
          "url": "https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUpgrade to version 1.35.227 or later.\u003c/span\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "\nUpgrade to version 1.35.227 or later.\n\n"
        }
      ],
      "source": {
        "advisory": "ILVN-2024-0147",
        "discovery": "UNKNOWN"
      },
      "title": "Unitronics Unistream Unilogic \u2013 Versions prior to 1.35.227  CWE-287: Improper Authentication",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a57ee1ae-c9c1-4f40-aa7b-cf10760fde3f",
    "assignerShortName": "INCD",
    "cveId": "CVE-2024-27767",
    "datePublished": "2024-03-18T13:13:36.868Z",
    "dateReserved": "2024-02-26T09:27:55.322Z",
    "dateUpdated": "2024-08-02T00:41:54.434Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

46 vulnerabilities by Unitronics

CVE-2026-45452 (GCVE-0-2026-45452)

CVE-2026-45451 (GCVE-0-2026-45451)

CVE-2026-45450 (GCVE-0-2026-45450)

CVE-2026-45449 (GCVE-0-2026-45449)

CVE-2024-38435 (GCVE-0-2024-38435)

CVE-2024-38434 (GCVE-0-2024-38434)

CVE-2024-1480 (GCVE-0-2024-1480)

CVE-2024-27774 (GCVE-0-2024-27774)

CVE-2024-27773 (GCVE-0-2024-27773)

CVE-2024-27772 (GCVE-0-2024-27772)

CVE-2024-27771 (GCVE-0-2024-27771)

CVE-2024-27770 (GCVE-0-2024-27770)

CVE-2024-27769 (GCVE-0-2024-27769)

CVE-2024-27768 (GCVE-0-2024-27768)

CVE-2024-27767 (GCVE-0-2024-27767)

CVE-2026-45452 (GCVE-0-2026-45452)

CVE-2026-45451 (GCVE-0-2026-45451)

CVE-2026-45450 (GCVE-0-2026-45450)

CVE-2026-45449 (GCVE-0-2026-45449)

CVE-2024-38435 (GCVE-0-2024-38435)

CVE-2024-38434 (GCVE-0-2024-38434)

CVE-2024-1480 (GCVE-0-2024-1480)

CVE-2024-27774 (GCVE-0-2024-27774)

CVE-2024-27773 (GCVE-0-2024-27773)

CVE-2024-27772 (GCVE-0-2024-27772)

CVE-2024-27771 (GCVE-0-2024-27771)

CVE-2024-27770 (GCVE-0-2024-27770)

CVE-2024-27769 (GCVE-0-2024-27769)

CVE-2024-27768 (GCVE-0-2024-27768)

CVE-2024-27767 (GCVE-0-2024-27767)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

46 vulnerabilities by Unitronics

CVE-2026-45452 (GCVE-0-2026-45452)

CVE-2026-45451 (GCVE-0-2026-45451)

CVE-2026-45450 (GCVE-0-2026-45450)

CVE-2026-45449 (GCVE-0-2026-45449)

CVE-2024-38435 (GCVE-0-2024-38435)

CVE-2024-38434 (GCVE-0-2024-38434)

CVE-2024-1480 (GCVE-0-2024-1480)

CVE-2024-27774 (GCVE-0-2024-27774)

CVE-2024-27773 (GCVE-0-2024-27773)

CVE-2024-27772 (GCVE-0-2024-27772)

CVE-2024-27771 (GCVE-0-2024-27771)

CVE-2024-27770 (GCVE-0-2024-27770)

CVE-2024-27769 (GCVE-0-2024-27769)

CVE-2024-27768 (GCVE-0-2024-27768)

CVE-2024-27767 (GCVE-0-2024-27767)

CVE-2026-45452 (GCVE-0-2026-45452)

CVE-2026-45451 (GCVE-0-2026-45451)

CVE-2026-45450 (GCVE-0-2026-45450)

CVE-2026-45449 (GCVE-0-2026-45449)

CVE-2024-38435 (GCVE-0-2024-38435)

CVE-2024-38434 (GCVE-0-2024-38434)

CVE-2024-1480 (GCVE-0-2024-1480)

CVE-2024-27774 (GCVE-0-2024-27774)

CVE-2024-27773 (GCVE-0-2024-27773)

CVE-2024-27772 (GCVE-0-2024-27772)

CVE-2024-27771 (GCVE-0-2024-27771)

CVE-2024-27770 (GCVE-0-2024-27770)

CVE-2024-27769 (GCVE-0-2024-27769)

CVE-2024-27768 (GCVE-0-2024-27768)

CVE-2024-27767 (GCVE-0-2024-27767)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.