Critical severity · published Dec 5, 2023
CVE-2023-6448
Unitronics VisiLogic uses a default administrative password
In wildKEV
9.8
CVSS
2.1%
EPSS
Yes
On KEV
Description
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildYes
CISA KEVListed Dec 11, 2023
Federal remediation dueDec 18, 2023
Ransomware campaign useNot known
Affected products
Which versions
VI
VisiLogic · Unitronics
before 9.9.00 · source: vendor, NVD, CISA
S3
Samba 3.5 Firmware · Unitronics
before 12.38 · source: NVD
S4
Samba 4.3 Firmware · Unitronics
before 12.38 · source: NVD
S7
Samba 7 Firmware · Unitronics
before 12.38 · source: NVD
VF
Vision1040 Firmware · Unitronics
before 12.38 · source: NVD
VF
Vision120 Firmware · Unitronics
before 12.38 · source: NVD
VF
Vision1210 Firmware · Unitronics
before 12.38 · source: NVD
VF
Vision130 Firmware · Unitronics
before 12.38 · source: NVD
VF
Vision230 Firmware · Unitronics
before 12.38 · source: NVD
VF
Vision280 Firmware · Unitronics
before 12.38 · source: NVD
VF
Vision290 Firmware · Unitronics
before 12.38 · source: NVD
VF
Vision350 Firmware · Unitronics
before 12.38 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-6448
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-6448
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
government-resource
https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems
www.unitronicsplc.com
https://www.unitronicsplc.com/cyber_security_vision-samba/
release-notes
https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdf
vendor-advisory
https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf
More from VisiLogic
7.5
CVE-2024-38435
Unitronics Vision PLC – CWE-703: Improper Check or Handling of Exceptional Conditions may allow denial of service