{"id":"CVE-2023-6448","aliases":["EUVD-2023-58685","GHSA-3r8p-3x67-72v8"],"status":"published","title":"Unitronics VisiLogic uses a default administrative password","description":"Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02089,"percentile":0.81737,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":false,"fix_available":false},"cwes":["CWE-1188","CWE-798"],"published":"2023-12-05T17:43:40Z","modified":"2026-06-17T06:50:46Z","kev":{"date_added":"2023-12-11","due_date":"2023-12-18","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2023-12-11"},{"source":"kev","since":"2023-12-11"}],"products":[{"vendor":"unitronics","product":"samba_3.5_firmware"},{"vendor":"unitronics","product":"samba_4.3_firmware"},{"vendor":"unitronics","product":"samba_7_firmware"},{"vendor":"unitronics","product":"visilogic"},{"vendor":"unitronics","product":"vision plc and hmi"},{"vendor":"unitronics","product":"vision1040_firmware"},{"vendor":"unitronics","product":"vision120_firmware"},{"vendor":"unitronics","product":"vision1210_firmware"},{"vendor":"unitronics","product":"vision130_firmware"},{"vendor":"unitronics","product":"vision230_firmware"},{"vendor":"unitronics","product":"vision280_firmware"},{"vendor":"unitronics","product":"vision290_firmware"},{"vendor":"unitronics","product":"vision350_firmware"},{"vendor":"unitronics","product":"vision430_firmware"},{"vendor":"unitronics","product":"vision530_firmware"},{"vendor":"unitronics","product":"vision560_firmware"},{"vendor":"unitronics","product":"vision570_firmware"},{"vendor":"unitronics","product":"vision700_firmware"}],"references":[{"url":"https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems","tags":["government-resource","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://www.unitronicsplc.com/cyber_security_vision-samba/","tags":["x_transferred","Product"]},{"url":"https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdf","tags":["release-notes","x_transferred","Release Notes"]},{"url":"https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf","tags":["vendor-advisory","x_transferred","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-6448","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6448"},{"url":"https://www.unitronicsplc.com/cyber_security_vision-samba"},{"url":"https://github.com/advisories/GHSA-3r8p-3x67-72v8"}],"sources":{"cve":[{"id":"CVE-2023-6448","title":"Unitronics VisiLogic uses a default administrative password","description":"Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.","status":"published","published":"2023-12-05T17:43:40.451Z","modified":"2025-10-21T23:05:30.29Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T14:35:25.095989Z"}],"euvd":[{"id":"EUVD-2023-58685","description":"Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.","status":"published","published":"2023-12-05T17:43:40Z","modified":"2025-10-21T23:05:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2023-12-11","updated_at":"2026-11-02T20:31:27.312976Z"}],"ghsa":[{"id":"GHSA-3r8p-3x67-72v8","title":"Unitronics Vision Series PLCs and HMIs use default administrative passwords. An unauthenticated...","description":"Unitronics Vision Series PLCs and HMIs use default administrative passwords. An unauthenticated attacker with network access to a PLC or HMI can take administrative control of the system.","status":"published","published":"2023-12-05T18:30:23Z","modified":"2025-10-22T00:32:58Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-798","CWE-1188"],"updated_at":"2026-11-02T15:04:07.112106Z"}],"kev":[{"id":"CVE-2023-6448","title":"Unitronics Vision PLC and HMI Insecure Default Password Vulnerability","description":"Unitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute remote commands.","cwes":["CWE-1188"],"kev":{"date_added":"2023-12-11","due_date":"2023-12-18","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2023-6448","description":"Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.","status":"published","published":"2023-12-05T18:15:12.643Z","modified":"2026-06-17T06:50:46.67Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-1188","CWE-798"],"updated_at":"2026-11-02T14:08:54.010507Z"}]}}