by Kastro
Paper/Archive/CVE-2023-6448

CVE-2023-6448

Unitronics VisiLogic — Unitronics VisiLogic uses a default administrative password

KEV · due 18 DecEPSS 2%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
96
CVSS 9.8 (CNA)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 81.6.816 × 2016.3Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.

Affected

ProductAffectedFixed inSource
VisiLogic< 9.9.009.9.00CNA
visilogic< 9.9.009.9.00CISA-ADP

Scores by source

cisa-cg (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systemsrefunitronicsplc.com/cyber_security_vision-sambarefdownloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdfadvisorydownloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdfrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-6448kevcisa.gov/known-exploited-vulnerabilities-catalog