Live › vulnerability › CVE-2023-6448
Go to dashboardUnitronics Vision Series PLCs and HMIs ship with a default password that stays in place unless the owner changes it. An attacker who knows or guesses that default can run remote commands on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Unitronics Vision PLC and HMI | vendor | – | – |
| unitronics vision1210 firmware | vendor | < 12.38 | 12.38 |
| unitronics vision1040 firmware | vendor | < 12.38 | 12.38 |
| unitronics vision700 firmware | vendor | < 12.38 | 12.38 |
| unitronics vision570 firmware | vendor | < 12.38 | 12.38 |
| unitronics vision560 firmware | vendor | < 12.38 | 12.38 |
| unitronics vision430 firmware | vendor | < 12.38 | 12.38 |
| unitronics vision350 firmware | vendor | < 12.38 | 12.38 |
| unitronics vision130 firmware | vendor | < 12.38 | 12.38 |
| unitronics vision230 firmware | vendor | < 12.38 | 12.38 |
| unitronics vision280 firmware | vendor | < 12.38 | 12.38 |
| unitronics vision290 firmware | vendor | < 12.38 | 12.38 |
| unitronics vision530 firmware | vendor | < 12.38 | 12.38 |
| unitronics vision120 firmware | vendor | < 12.38 | 12.38 |
| unitronics visilogic | vendor | < 9.9.00 | 9.9.00 |
| unitronics samba 3.5 firmware | vendor | < 12.38 | 12.38 |
| unitronics samba 4.3 firmware | vendor | < 12.38 | 12.38 |
| unitronics samba 7 firmware | vendor | < 12.38 | 12.38 |
Check whether any Unitronics Vision PLC or HMI still uses the factory default password.
Change the default password on every Unitronics Vision device, following the vendor instructions; if no mitigation is available, discontinue use of the product (per CISA).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute remote commands.
CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2023-6448")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.