CVE-2023-6448
Unitronics Vision PLC and HMI Insecure Default Password Vulnerability
Description
CVE-2023-6448 is a critical vulnerability in Unitronics VisiLogic software (versions before 9.9.00), used to program and manage Unitronics Vision and Samba PLCs and HMIs. The vulnerability involves the use of a default administrative password (CWE-1188 and CWE-798), meaning these industrial control devices ship with a well-known, hardcoded credential that is not required to be changed during setup. An unauthenticated attacker with network access can exploit CVE-2023-6448 to gain full administrative control over any unpatched device, affecting industrial operations including water and wastewater systems. CISA confirmed active exploitation of CVE-2023-6448 and issued an alert regarding its use against critical infrastructure, with a KEV remediation deadline of December 18, 2023.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| unitronics | vision1210 firmware | < 12.38 |
| unitronics | vision1040 firmware | < 12.38 |
| unitronics | vision700 firmware | < 12.38 |
| unitronics | vision570 firmware | < 12.38 |
| unitronics | vision560 firmware | < 12.38 |
| unitronics | vision430 firmware | < 12.38 |
| unitronics | vision350 firmware | < 12.38 |
| unitronics | vision130 firmware | < 12.38 |
| unitronics | vision230 firmware | < 12.38 |
| unitronics | vision280 firmware | < 12.38 |
| unitronics | vision290 firmware | < 12.38 |
| unitronics | vision530 firmware | < 12.38 |
| unitronics | vision120 firmware | < 12.38 |
| unitronics | visilogic | < 9.9.00 |
| unitronics | samba 3.5 firmware | < 12.38 |
| unitronics | samba 4.3 firmware | < 12.38 |
| unitronics | samba 7 firmware | < 12.38 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf(Vendor Advisory)
- https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdf(Release Notes)
- https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems(Third Party Advisory, US Government Resource)
- https://www.unitronicsplc.com/cyber_security_vision-samba/(Product)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-6448(US Government Resource)
Weakness Type
CWE-1188: Initialization with an Insecure Default
CVE-2023-6448 is partly caused by insecure initialization — Unitronics VisiLogic configures Vision and Samba PLCs with a default administrative password that is publicly known and not enforced to be changed. This means devices are deployed in an insecure state from the outset, with full administrative access available to anyone who knows the default credential.
Learn more: CWE-1188 — Initialization with an Insecure Default
CWE-798: Use of Hard-coded Credentials
The vulnerability also involves hard-coded credentials (CWE-798): a fixed default password is embedded in the product design and used for administrative authentication. Because this password is not unique per device and is not required to be changed, it effectively provides a skeleton key for any attacker aware of the default value.
Learn more: CWE-798 — Use of Hard-coded Credentials
Impact Analysis
CVE-2023-6448 holds a CVSS v3.1 base score of 9.8 (CRITICAL). The attack vector is Network, attack complexity is Low, no privileges are required, and no user interaction is needed — any unauthenticated attacker with network access to a vulnerable device can immediately take full administrative control.
Confidentiality Impact: High — An attacker can read all device data, including process parameters, operational logic, and credentials.
Integrity Impact: High — The attacker can modify PLC logic, alter setpoints, disable safety mechanisms, or disrupt industrial processes.
Availability Impact: High — Industrial operations dependent on these PLCs can be halted or disrupted.
CISA documented exploitation of this vulnerability specifically against water and wastewater systems, where manipulation of PLC logic could have direct physical consequences. The EPSS score of 0.133 (94th percentile) reflects significant exploitation probability, consistent with the confirmed real-world attacks.
Exploit Maturity
CVE-2023-6448 was actively exploited against critical infrastructure. CISA issued a dedicated alert (November 28, 2023) documenting exploitation of Unitronics PLCs used in water and wastewater systems, describing cases where threat actors obtained administrative control via the default password. CISA added CVE-2023-6448 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation due date of December 18, 2023. The EPSS score is 0.133 (94th percentile). Ransomware association is listed as Unknown, though the industrial control system context makes this vulnerability particularly severe from a physical safety perspective.
Remediation
- Update Unitronics VisiLogic to version 9.9.00 or later immediately. The updated software addresses the default password vulnerability.
- Change the default administrative password on all Vision and Samba PLC/HMI devices to a strong, unique password before connecting them to any network.
- Isolate PLC/HMI devices from the internet — industrial control systems should never be directly internet-accessible. Use firewalls, network segmentation, and VPNs for remote access.
- Enforce multi-factor authentication for any remote access to OT networks and industrial control panels.
- Audit all Unitronics devices in the environment (Vision 1210, 1040, 700, 570, 560, 430, 350, 130, 230, 280, 290, 530, 120; Samba 3.5, 4.3, 7) for the presence of default credentials.
- Apply mitigations per vendor instructions as documented in the CISA KEV listing and the Unitronics cybersecurity advisory (CVE-2023-6448).
- Consult the CISA alert on exploitation of Unitronics PLCs in water and wastewater systems for sector-specific guidance.
Technical Details
CVE-2023-6448 exists in Unitronics VisiLogic before version 9.9.00, the software used to configure Vision and Samba series PLCs and HMIs. The root causes are two related weaknesses:
CWE-1188 (Insecure Default Initialization): Devices are initialized with a publicly known default administrative password. The software does not enforce or prompt users to set a unique password during initial setup.
CWE-798 (Hard-coded Credentials): The administrative password is hard-coded or set to a fixed default value across all devices, making it trivially guessable for any attacker who consults public documentation, security advisories, or previous disclosures.
Attack scenario: An unauthenticated attacker with network access (including over the internet if the device is exposed) can use the default administrative password to log in and gain full control over the PLC or HMI. From this position, the attacker can reprogram device logic, alter industrial process parameters, disable safety systems, or disrupt operations entirely.
Affected models: Unitronics Vision series (1210, 1040, 700, 570, 560, 430, 350, 130, 230, 280, 290, 530, 120) and Samba series (3.5, 4.3, 7) using VisiLogic before 9.9.00.
Real-world exploitation: CISA documented attacks on U.S. water and wastewater facilities using this vulnerability, highlighting the critical infrastructure risk posed by insecurely configured industrial control systems.
Frequently Asked Questions
What is CVE-2023-6448?
CVE-2023-6448 is a critical vulnerability in Unitronics VisiLogic (before version 9.9.00) affecting Vision and Samba PLCs and HMIs. Devices use a default administrative password, allowing any unauthenticated attacker with network access to take full administrative control.
Has CVE-2023-6448 been exploited in the real world?
Yes. CISA documented active exploitation of this vulnerability against U.S. water and wastewater facilities and issued a dedicated alert in November 2023. The vulnerability was added to the CISA KEV catalog with a December 18, 2023 remediation deadline.
Which Unitronics products are affected by CVE-2023-6448?
All Unitronics Vision PLC and Samba HMI devices managed by VisiLogic versions before 9.9.00 are affected, including Vision 120, 130, 230, 280, 290, 350, 430, 530, 560, 570, 700, 1040, 1210 and Samba 3.5, 4.3, and 7 firmware variants.
How do I remediate CVE-2023-6448?
Update VisiLogic to version 9.9.00 or later and immediately change the default administrative password on all affected devices. Isolate PLC/HMI devices from direct internet access and restrict management access to trusted network segments.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.