CVE-2023-6448
Published 2023-12-05 · Updated 2026-06-17 · Source 9119a7d8-5eab-497f-8521-727c672e3725
Summary
CVE-2023-6448 is a critical-severity (CVSS 9.8) vulnerability in Unitronics Vision PLC and HMI. CISA added it to the Known Exploited Vulnerabilities catalog on December 11, 2023, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by December 18, 2023. CISA does not currently list it as used in ransomware campaigns.
All 1 known-exploited Unitronics vulnerabilities →Description
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Unitronics — Vision PLC and HMI
Name: Unitronics Vision PLC and HMI Insecure Default Password Vulnerability
Date added: 2023-12-11 · Due: 2023-12-18
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
References
- https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf
- https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdf
- https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems
- https://www.unitronicsplc.com/cyber_security_vision-samba/
- https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf
- https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdf
- https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems
- https://www.unitronicsplc.com/cyber_security_vision-samba/