CVE-2023-6448: Unitronics VisiLogic uses a default administrative password
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.
Other sources
Unitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute remote commands.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change the insecure default administrative password on Unitronics Vision and Samba PLCs and HMIs.
Unitronics VisiLogic administrative authentication administrative password = non-default password - Compensating control
Discontinue use of Unitronics VisiLogic in Vision and Samba PLCs and HMIs if mitigations are unavailable.
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6448?
CVE-2023-6448 is a high severity vulnerability due to the use of a default administrative password that allows unauthorized access to systems.
How do I fix CVE-2023-6448?
To fix CVE-2023-6448, update VisiLogic to version 9.9.00 or later and ensure that default passwords are changed immediately.
Which products are affected by CVE-2023-6448?
CVE-2023-6448 affects various Unitronics Vision and Samba PLCs and HMIs prior to VisiLogic version 9.9.00.
Can CVE-2023-6448 be exploited remotely?
Yes, CVE-2023-6448 can be exploited remotely by an unauthenticated attacker with network access.
What is the impact of CVE-2023-6448 on vulnerable systems?
The impact of CVE-2023-6448 includes potential full administrative control of affected systems by unauthorized users.