cyfenced.com →

[ CVE-2023-6448 · Published 5 Dec 2023 ]

Unitronics Vision PLC and HMI Insecure Default Password Vulnerability

Exploited · CISA KEV CVSS 9.8 EPSS 2%No fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-12-11
  • Critical severity: CVSS 9.8

[ Description ]Official description

Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.

CISA: Unitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute remote commands.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 18 Dec 2023): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References