CVE-2023-6448

critical · 9.8Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Added 2023-12-11Remediation due 2023-12-18

Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.

9.8

CVSS

2.1%

EPSS (exploit prob.)

81st

EPSS percentile

2023-12-05

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-1188CWE-798

Affected products

Vendor	Product	Affected versions
unitronics	vision1210_firmware	< 12.38
unitronics	vision1210	all versions
unitronics	vision1040_firmware	< 12.38
unitronics	vision1040	all versions
unitronics	vision700_firmware	< 12.38
unitronics	vision700	all versions
unitronics	vision570_firmware	< 12.38
unitronics	vision570	all versions
unitronics	vision560_firmware	< 12.38
unitronics	vision560	all versions
unitronics	vision430_firmware	< 12.38
unitronics	vision430	all versions
unitronics	vision350_firmware	< 12.38
unitronics	vision350	all versions
unitronics	vision130_firmware	< 12.38
unitronics	vision130	all versions
unitronics	vision230_firmware	< 12.38
unitronics	vision230	all versions
unitronics	vision280_firmware	< 12.38
unitronics	vision280	all versions
unitronics	vision290_firmware	< 12.38
unitronics	vision290	all versions
unitronics	vision530_firmware	< 12.38
unitronics	vision530	all versions
unitronics	vision120_firmware	< 12.38
unitronics	vision120	all versions
unitronics	visilogic	< 9.9.00
unitronics	samba_3.5_firmware	< 12.38
unitronics	samba_3.5	all versions
unitronics	samba_4.3_firmware	< 12.38
unitronics	samba_4.3	all versions
unitronics	samba_7_firmware	< 12.38
unitronics	samba_7	all versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2023-6448