CVE-2023-6448

critical-risk
Published 2023-12-05

Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.

Do I need to act?

!
13.3% chance of exploitation in next 30 days
EPSS score — higher than 87% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (17)

Affected Vendors

Unitronics

References (9)

Vendor Advisory https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cyber...
Release Notes https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Repo...
Third Party Advisory https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-...
Product https://www.unitronicsplc.com/cyber_security_vision-samba/
Vendor Advisory https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cyber...
Release Notes https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Repo...
Third Party Advisory https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-...
Product https://www.unitronicsplc.com/cyber_security_vision-samba/
US Government Resource https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-...
70
/ 100
critical-risk
Severity 32/34 · Critical
Exploitability 19/34 · Moderate
Exposure 19/34 · Moderate