{"id":"CVE-2023-6448","kind":"vulnerability","aliases":["CVE-2023-6448"],"related":[],"title":"Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative…","description":"Unitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute remote commands.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"Unitronics Vision Series PLCs and HMIs ship with a default password that stays in place unless the owner changes it. An attacker who knows or guesses that default can run remote commands on the device.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2023-12-11T00:00:00+00:00","products":[{"name":"Unitronics Vision PLC and HMI","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"unitronics vision1210 firmware","fixed":["12.38"],"affected":"< 12.38","ecosystem":"vendor"},{"name":"unitronics vision1040 firmware","fixed":["12.38"],"affected":"< 12.38","ecosystem":"vendor"},{"name":"unitronics vision700 firmware","fixed":["12.38"],"affected":"< 12.38","ecosystem":"vendor"},{"name":"unitronics vision570 firmware","fixed":["12.38"],"affected":"< 12.38","ecosystem":"vendor"},{"name":"unitronics vision560 firmware","fixed":["12.38"],"affected":"< 12.38","ecosystem":"vendor"},{"name":"unitronics vision430 firmware","fixed":["12.38"],"affected":"< 12.38","ecosystem":"vendor"},{"name":"unitronics vision350 firmware","fixed":["12.38"],"affected":"< 12.38","ecosystem":"vendor"},{"name":"unitronics vision130 firmware","fixed":["12.38"],"affected":"< 12.38","ecosystem":"vendor"},{"name":"unitronics vision230 firmware","fixed":["12.38"],"affected":"< 12.38","ecosystem":"vendor"},{"name":"unitronics vision280 firmware","fixed":["12.38"],"affected":"< 12.38","ecosystem":"vendor"},{"name":"unitronics vision290 firmware","fixed":["12.38"],"affected":"< 12.38","ecosystem":"vendor"},{"name":"unitronics vision530 firmware","fixed":["12.38"],"affected":"< 12.38","ecosystem":"vendor"},{"name":"unitronics vision120 firmware","fixed":["12.38"],"affected":"< 12.38","ecosystem":"vendor"},{"name":"unitronics visilogic","fixed":["9.9.00"],"affected":"< 9.9.00","ecosystem":"vendor"},{"name":"unitronics samba 3.5 firmware","fixed":["12.38"],"affected":"< 12.38","ecosystem":"vendor"},{"name":"unitronics samba 4.3 firmware","fixed":["12.38"],"affected":"< 12.38","ecosystem":"vendor"},{"name":"unitronics samba 7 firmware","fixed":["12.38"],"affected":"< 12.38","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","hmi","industrial-control","infrastructure","ot","plc","unitronics"],"not_affected_if":["default-password-changed"],"how_to_check":"Check whether any Unitronics Vision PLC or HMI still uses the factory default password.","fix":"Change the default password on every Unitronics Vision device, following the vendor instructions; if no mitigation is available, discontinue use of the product (per CISA).","status":"open","published_at":"2023-12-05T18:15:12+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:02:40+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:02:40Z","model":"claude-haiku-5-5","output":{"fix":"Change the default password on every Unitronics Vision device, following the vendor instructions; if no mitigation is available, discontinue use of the product (per CISA).\nunknown","reach":"network","impact":"high","summary":"Unitronics Vision Series PLCs and HMIs ship with a default password that stays in place unless the owner changes it. An attacker who knows or guesses that default can run remote commands on the device.","category":"infrastructure","who_cares":["unitronics","plc","hmi","industrial-control","ot"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs arbitrary remote commands on the industrial controller.","analyst_note":"Find the vendor advisory and affected firmware versions and the exact remote command interface and port; the sources do not name them (CISA KEV entry only).","how_to_check":"Check whether any Unitronics Vision PLC or HMI still uses the factory default password.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["default-password-changed"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000478,"input_tokens":2831,"output_tokens":390,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':19A,22A '-6448':20A,23A '3.5':72A '4.3':76A '7':80A '9.9.00':5A 'action':151C 'administr':17A 'allow':143C 'and':27A 'appli':152C 'attack':112B,144C 'chang':109B 'cisa':149C 'command':122B,148C 'control':86B 'cve':18A,21A 'default':16A,100B,118B,136C 'devic':125B 'discontinu':158C 'execut':146C 'exploit':82B 'firmware':31A,34A,37A,40A,43A,46A,49A,52A,55A,58A,61A,64A,67A,73A,77A,81A 'guess':116B 'hmi':28A,83B 'hmis':13A,96B,131C 'industri':85B 'industrial-control':84B 'infrastructur':87B 'insecur':135C 'instruct':156C 'know':114B 'left':140C 'mitig':153C,164C 'ot':88B 'owner':108B 'password':101B,137C 'per':154C 'place':105B 'plc':26A,89B 'plcs':11A,94B,129C 'product':162C 'remot':121B,147C 'requir':150C 'run':120B 'samba':10A,71A,75A,79A 'seri':93B,128C 'ship':97B,132C 'stay':103B 'unavail':166C 'unchang':141C 'unitron':1A,90B,91B,126C 'unitronics':24A,29A,32A,35A,38A,41A,44A,47A,50A,53A,56A,59A,62A,65A,68A,70A,74A,78A 'unless':106B 'use':6A,14A,159C 'vendor':155C 'version':4A 'visilog':2A 'visilogic':69A 'vision':8A,25A,92B,127C 'vision1040':33A 'vision120':66A 'vision1210':30A 'vision130':51A 'vision230':54A 'vision280':57A 'vision290':60A 'vision350':48A 'vision430':45A 'vision530':63A 'vision560':42A 'vision570':39A 'vision700':36A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-12-05T18:15:12+00:00","kev":{"dateAdded":"2023-12-11","dueDate":"2023-12-18","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"9119a7d8-5eab-497f-8521-727c672e3725","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-6448","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-6448","severity":null,"published_at":"2023-12-11T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:39+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-6448","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6448","severity":null,"published_at":"2023-12-05T18:15:12+00:00","modified_at":"2026-06-17T06:50:46+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}