Vulnerability Details : CVE-2023-6448
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.
Published
2023-12-05 18:15:13
Updated
2025-01-27 21:52:49
Products affected by CVE-2023-6448
- cpe:2.3:o:unitronics:vision1210_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:unitronics:vision1040_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:unitronics:vision700_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:unitronics:vision570_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:unitronics:vision560_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:unitronics:vision430_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:unitronics:vision350_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:unitronics:vision130_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:unitronics:vision230_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:unitronics:vision280_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:unitronics:vision290_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:unitronics:vision530_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:unitronics:vision120_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:a:unitronics:visilogic:*:*:*:*:*:*:*:*
- cpe:2.3:o:unitronics:samba_3.5_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:unitronics:samba_4.3_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:unitronics:samba_7_firmware:*:*:*:*:*:*:*:*
CVE-2023-6448 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
Unitronics Vision PLC and HMI Insecure Default Password Vulnerability
CISA required action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA description:
Unitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute remote commands.
Notes:
Note that while it is possible to change the default password, implementors are encouraged to remove affected controllers from public networks and update the affected firmware: https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pd
Added on
2023-12-11
Action due date
2023-12-18
Exploit prediction scoring system (EPSS) score for CVE-2023-6448
16.16%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 94 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-6448
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government | |
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2023-6448
-
The product contains hard-coded credentials, such as a password or cryptographic key.Assigned by: nvd@nist.gov (Primary)
-
The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.Assigned by: 9119a7d8-5eab-497f-8521-727c672e3725 (Secondary)
References for CVE-2023-6448
-
https://www.unitronicsplc.com/cyber_security_vision-samba/
Cyber ProtectionProduct
-
https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems
Exploitation of Unitronics PLCs used in Water and Wastewater Systems | CISAThird Party Advisory;US Government Resource
-
https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf
Vendor Advisory
-
https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdf
Release Notes
Jump to