peter bassill · operator
$ cve CVE-2023-6448 JSON

CVE-2023-6448 KEV

9.8
CRITICAL · CVSS 3.1 · EPSS 2.1% (pctl 81)

Patch first

On CISA KEV — known exploited in the wild, due 2023-12-18.

Description

Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS2.07% — more likely to be exploited than 81% of all CVEs
WeaknessCWE-1188
On CISA KEVyes — remediate by 2023-12-18
Public exploitnone known
Published2023-12-05
Last modified2026-06-17

CISA KEV

NameUnitronics Vision PLC and HMI Insecure Default Password Vulnerability
Added2023-12-11
Due2023-12-18
Vendor / productUnitronics / Vision PLC and HMI
Ransomware usenone reported

Affected (33)

VendorProduct
unitronicssamba 3.5
unitronicssamba 3.5 firmware
unitronicssamba 4.3
unitronicssamba 4.3 firmware
unitronicssamba 7
unitronicssamba 7 firmware
unitronicsvisilogic
unitronicsvision1040
unitronicsvision1040 firmware
unitronicsvision120
unitronicsvision120 firmware
unitronicsvision1210
unitronicsvision1210 firmware
unitronicsvision130
unitronicsvision130 firmware
unitronicsvision230
unitronicsvision230 firmware
unitronicsvision280
unitronicsvision280 firmware
unitronicsvision290
unitronicsvision290 firmware
unitronicsvision350
unitronicsvision350 firmware
unitronicsvision430
unitronicsvision430 firmware
unitronicsvision530
unitronicsvision530 firmware
unitronicsvision560
unitronicsvision560 firmware
unitronicsvision570
unitronicsvision570 firmware
unitronicsvision700
unitronicsvision700 firmware

References

→ the Explorer  ·  watch your stack  ·  NVD