The vulnerability is a use of an externally controlled format string, which can allow an attacker to influence the way the software processes user-supplied data. If exploited, this flaw could lead to program crashes, denial of service, or uncontrolled execution of arbitrary instructions, compromising both application integrity and confidentiality.

Affected systems include Unitronics UniStream Pro (B10 / C10) and UniLogic versions older than 1.41.329. These products are used in industrial control environments and may run critical process logic.

The CVSS score of 8.3 indicates high severity. The EPSS score of less than 1% suggests a low current exploitation probability, and the flaw is not listed in CISA’s KEV catalog. The attack appears to require that an adversary inject a crafted format string into an input field or network interface managed by the UniStream Pro/UniLogic device; the precise vector is not detailed, so it could be either local or remote depending on how the input is exposed. No immediate mitigations beyond patching are documented, and the exploitation potential warrants prompt remediation.