SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityAnalyzed

CVE-2023-6448

Unitronics Vision PLC and HMI Insecure Default Password Vulnerability

KEVCRITICAL 9.8EPSS 2.07%

Does this matter?

Known to be exploited in the wild (CISA KEV, CISA remediation deadline 18 December 2023). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.

Description

Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.

CVSS 3.1
9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
2.07% probability · 80th percentile
CISA KEV
Listed 11 December 2023 · due 18 December 2023
Weakness
CWE-1188, CWE-798
Affected
unitronics/vision1210 firmware · unitronics/vision1040 firmware · unitronics/vision700 firmware · unitronics/vision570 firmware · unitronics/vision560 firmware · unitronics/vision430 firmware · unitronics/vision350 firmware · unitronics/vision130 firmware · unitronics/vision230 firmware · unitronics/vision280 firmware · unitronics/vision290 firmware · unitronics/vision530 firmware · unitronics/vision120 firmware · unitronics/visilogic · unitronics/samba 3.5 firmware · unitronics/samba 4.3 firmware · unitronics/samba 7 firmware
Source
9119a7d8-5eab-497f-8521-727c672e3725

CISA notes

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Note that while it is possible to change the default password, implementors are encouraged to remove affected controllers from public networks and update the affected firmware: https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf; https://nvd.nist.gov/vuln/detail/CVE-2023-6448

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.