CVE-2023-6448
Unitronics Vision PLC and HMI Insecure Default Password Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 18 December 2023). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.09% probability · 82th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Listed 11 December 2023 · due 18 December 2023
- Weakness
- CWE-1188, CWE-798
- Affected
- unitronics/vision1210 firmware · unitronics/vision1040 firmware · unitronics/vision700 firmware · unitronics/vision570 firmware · unitronics/vision560 firmware · unitronics/vision430 firmware · unitronics/vision350 firmware · unitronics/vision130 firmware · unitronics/vision230 firmware · unitronics/vision280 firmware · unitronics/vision290 firmware · unitronics/vision530 firmware · unitronics/vision120 firmware · unitronics/visilogic · unitronics/samba 3.5 firmware · unitronics/samba 4.3 firmware · unitronics/samba 7 firmware
- Source
- 9119a7d8-5eab-497f-8521-727c672e3725
EPSS 2.1% since 30 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
CISA notes
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Note that while it is possible to change the default password, implementors are encouraged to remove affected controllers from public networks and update the affected firmware: https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf; https://nvd.nist.gov/vuln/detail/CVE-2023-6448
References
- https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdfVendor Advisory
- https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdfRelease Notes
- https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systemsThird Party Advisory, US Government Resource
- https://www.unitronicsplc.com/cyber_security_vision-samba/Product
- https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdfVendor Advisory
- https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdfRelease Notes
- https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systemsThird Party Advisory, US Government Resource
- https://www.unitronicsplc.com/cyber_security_vision-samba/Product
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-6448US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.