NetSight
IP …
critical9.8Known exploited

CVE-2023-6448

Unitronics Vision PLC and HMI Insecure Default Password Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2023-12-11. Federal due date: 2023-12-18.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Impact

Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.

Affected products

VendorProductAffected versions
UnitronicsVision1210 Firmware
before 12.38
UnitronicsVision1040 Firmware
before 12.38
UnitronicsVision700 Firmware
before 12.38
UnitronicsVision570 Firmware
before 12.38
UnitronicsVision560 Firmware
before 12.38
UnitronicsVision430 Firmware
before 12.38
UnitronicsVision350 Firmware
before 12.38
UnitronicsVision130 Firmware
before 12.38
UnitronicsVision230 Firmware
before 12.38
UnitronicsVision280 Firmware
before 12.38
UnitronicsVision290 Firmware
before 12.38
UnitronicsVision530 Firmware
before 12.38

Weakness classification

CWE-1188CWE-798

References