CVEvulnerability

CVE-2023-6448

9.8 CRITICAL Known exploited Published 2023-12-05 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Unitronics Vision PLC and HMI Insecure Default Password Vulnerability — Unitronics Vision PLC and HMI

Unitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute remote commands.

Added to KEV
2023-12-11
Remediation due
2023-12-18
Ransomware use
Unknown
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes
Note that while it is possible to change the default password, implementors are encouraged to remove affected controllers from public networks and update the affected firmware: https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf; https://nvd.nist.gov/vuln/detail/CVE-2023-6448
Status
Analyzed
Published
2023-12-05
Last modified
2026-06-17
Assigner
9119a7d8-5eab-497f-8521-727c672e3725
CVSS 3.1 (9119a7d8-5eab-497f-8521-727c672e3725)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1188, CWE-798

Description

Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.

Affected configurations

• unitronics vision1210 firmware (< 12.38) • unitronics vision1040 firmware (< 12.38) • unitronics vision700 firmware (< 12.38) • unitronics vision570 firmware (< 12.38) • unitronics vision560 firmware (< 12.38) • unitronics vision430 firmware (< 12.38) • unitronics vision350 firmware (< 12.38) • unitronics vision130 firmware (< 12.38) • unitronics vision230 firmware (< 12.38) • unitronics vision280 firmware (< 12.38) • unitronics vision290 firmware (< 12.38) • unitronics vision530 firmware (< 12.38) • unitronics vision120 firmware (< 12.38) • unitronics visilogic (< 9.9.00) • unitronics samba 3.5 firmware (< 12.38) • unitronics samba 4.3 firmware (< 12.38) • unitronics samba 7 firmware (< 12.38)

Related

Weakness · CWE (2)

  • CWE-1188 Initialization of a Resource with an Insecure Default weakness
  • CWE-798 Use of Hard-coded Credentials weakness

References