PT-2024-2275 · Unitronics · Unilogic Studio+2

Published 2024-03-18 · Updated 2024-03-18 · CVE-2024-27774

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Unitronics Unistream Unilogic versions prior to 1.35.227

Description The issue is related to the use of hard-coded passwords, which may allow an attacker to disclose sensitive information embedded inside the device's firmware. This could potentially enable unauthorized access to protected information. The vulnerability is associated with the use of pre-installed credentials in the UniLogic Studio series UniStream programmable logic controllers.

Recommendations For versions prior to 1.35.227, update to version 1.35.227 or later to resolve the issue. As a temporary workaround, consider restricting access to the device to minimize the risk of exploitation. Avoid using default or hard-coded passwords in the affected devices until the issue is resolved.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-259

CWE-798

Related Identifiers

BDU:2024-02208

CVE-2024-27774

Affected Products

Unilogic Studio

Unistream

Unilogic

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-27774 · Security Note
• https://bdu.fstec.ru/vul/2024-02208 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27774 · Vendor Advisory
• https://twitter.com/cracbot/status/1769964458418311370 · Twitter Post
• https://twitter.com/CVEnew/status/1769723595540885835 · Twitter Post
• https://gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0 · Note
• https://claroty.com/team82/disclosure-dashboard/cve-2024-27774 · Note
• https://twitter.com/VulmonFeeds/status/1769765440861896920 · Twitter Post
• https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered · Note