CVE-2023-6448
Unitronics Vision PLC and HMI Insecure Default Password Vulnerability
Published Dec 5, 2023 · updated Jun 16, 2026 · unitronics vision1210 firmware
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.
Timeline
Detection, updates, and resolution for this record.
Dec 5, 2023 · Catalog
Detected
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.
Dec 11, 2023 · CISA KEV
Known exploited
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Dec 18, 2023 · CISA KEV
Remediation due
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Jun 16, 2026 · Catalog
Updated
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date Dec 18, 2023
Affected
- cpe unitronics/vision1040 firmwareversion unspecified
- cpe unitronics/vision1210 firmwareversion unspecified
- cpe unitronics/vision130 firmwareversion unspecified
- cpe unitronics/vision230 firmwareversion unspecified
- cpe unitronics/vision280 firmwareversion unspecified
- cpe unitronics/vision290 firmwareversion unspecified
- cpe unitronics/vision350 firmwareversion unspecified
- cpe unitronics/vision430 firmwareversion unspecified
- cpe unitronics/vision530 firmwareversion unspecified
- cpe unitronics/vision560 firmwareversion unspecified
- cpe unitronics/vision570 firmwareversion unspecified
- cpe unitronics/vision700 firmwareversion unspecified
- vendor Unitronics Vision PLC and HMIversion unspecified
Sources
- CISA KEVCVE-2023-6448
Unitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute remote commands.
cisa.gov - CVE.orgCVE-2023-6448
Official CVE identifier
cve.org - FIRST EPSSCVE-2023-6448
30-day exploitation probability 2.1%
first.org - NIST NVDCVE-2023-6448
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.
nvd.nist.gov