CVE-2024-27768

The CWE-22 (path traversal) vulnerability consists of insufficient validation of file paths transmitted over the network, allowing an attacker to escape the application's permitted directory. By sending an appropriately crafted request containing sequences such as '../', the attacker can access any files on the system or place a malicious file in a critical location. As a result, remote code execution on the target device is possible.

An attacker can gain full control over the device without authentication, obtaining access to sensitive data, modifying system configuration, and executing arbitrary code (RCE), which in an industrial environment can lead to disruption or sabotage of control processes.

Update Unitronics Unistream Unilogic software to version 1.35.227 or newer. Detailed information is available in the manufacturer's references and in the guide published by Claroty Team82.

Unitronics Unistream Unilogic in versions earlier than 1.35.227