CVE-2023-6448
Unitronics Vision PLC and HMI Insecure Default Password Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 18 December 2023). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.07% probability · 80th percentile
- CISA KEV
- Listed 11 December 2023 · due 18 December 2023
- Weakness
- CWE-1188, CWE-798
- Affected
- unitronics/vision1210 firmware · unitronics/vision1040 firmware · unitronics/vision700 firmware · unitronics/vision570 firmware · unitronics/vision560 firmware · unitronics/vision430 firmware · unitronics/vision350 firmware · unitronics/vision130 firmware · unitronics/vision230 firmware · unitronics/vision280 firmware · unitronics/vision290 firmware · unitronics/vision530 firmware · unitronics/vision120 firmware · unitronics/visilogic · unitronics/samba 3.5 firmware · unitronics/samba 4.3 firmware · unitronics/samba 7 firmware
- Source
- 9119a7d8-5eab-497f-8521-727c672e3725
CISA notes
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Note that while it is possible to change the default password, implementors are encouraged to remove affected controllers from public networks and update the affected firmware: https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf; https://nvd.nist.gov/vuln/detail/CVE-2023-6448
References
- https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdfVendor Advisory
- https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdfRelease Notes
- https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systemsThird Party Advisory, US Government Resource
- https://www.unitronicsplc.com/cyber_security_vision-samba/Product
- https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdfVendor Advisory
- https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdfRelease Notes
- https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systemsThird Party Advisory, US Government Resource
- https://www.unitronicsplc.com/cyber_security_vision-samba/Product
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-6448US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.