Cybercriminals are actively targeting Unitronics PLCs, which are crucial for controlling and monitoring water and wastewater treatment processes. This poses a significant threat to public health and safety as compromised systems could disrupt essential services.
CVE-2023-6448 Unitronics Vision Series PLCs and HMIs use default passwords
Cyber threat actors are targeting PLCs associated with WWS facilities, including an identified Unitronics PLC, at a U.S. water facility. The affected facility immediately took operations offline and switched to manual mode, preventing any harm to water quality or supply. However, the incident highlights the vulnerability of critical infrastructure to cyberattacks.
Recommendations:
Change default passwords:
Update all weak passwords on PLCs and Human Machine Interfaces (HMIs) with strong, unique credentials.
Enable multi-factor authentication:
Implement multi-factor authentication for all remote access to the operational technology (OT) network.
Disconnect from the internet:
Disconnect PLCs from the internet whenever possible.
Secure remote access:
For necessary remote access, utilize a firewall, VPN, and IP allowlist.
Backup and update:
Regularly back up PLC configurations and update systems to the latest versions.
Change default port:
Consider using a non-default port for PLC communication to avoid targeted attacks.
Filter PCOM/TCP packets:
Implement PCOM/TCP filters to mitigate potential attacks.
By implementing these security measures, organizations can significantly reduce the risk of cyberattacks on their critical infrastructure and protect public safety.
For further information read the CISA alert.
