Actively exploited · Published Dec 5, 2023 · Assigned by cisa-cg

CVE-2023-6448Unitronics VisiLogic uses a default administrative password

Critical 9.8 Exploited

In plain English

A critical-severity security flaw in VisiLogic from Unitronics. Attackers are actively exploiting it in the wild (listed by CISA on December 11, 2023). The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)2.1%top 18.3% of all CVEs

Exploited in the wildYesCISA KEV since Dec 11, 2023

Attack toolingNoneno public tooling known

CISA guidance

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by Dec 18, 2023.

Official description

Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.

Affected products (as reported)

Vendor	Product	Versions
Unitronics	VisiLogic	0 – before 9.9.00

Weakness: CWE-1188 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In plain English

CISA guidance

Official description

Affected products (as reported)

References