CVE-2023-6448criticalunder attackCWE-1188

CVE-2023-6448: critical vulnerability in Unitronics VisiLogic

Unitronics VisiLogic uses a default administrative password

Published · Updated

Follow this CVE+ Monitor VisiLogic+ Monitor Vision PLC and HMI

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

58Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.8epss 2.1%
from disclosure to weapon
Published on NVDDec 5
CISA KEV+6d
Action required by CISAfederal deadline: 2023-12-18

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

Unitronics VisiLogic software comes with a default administrative password that never changes. An attacker on the network can use this password to gain full control of the system without needing valid credentials.

Technical detail

CWE-1188 involves hardcoded default credentials in Unitronics VisiLogic versions prior to 9.9.00. An unauthenticated remote attacker with network access to the affected Vision or Samba PLC/HMI can authenticate using the default administrative password to achieve complete system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Unitronics · VisiLogic