{"id":"CVE-2023-6448","published":"2023-12-05T18:15:12Z","modified":"2026-06-17T06:50:46Z","title":"Unitronics Vision PLC and HMI Insecure Default Password Vulnerability","vendor":"Unitronics","product":"Vision PLC and HMI","tier":"core","eol":null,"description":{"text":"Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.","provenance":"source","from":"NVD"},"summary":{"text":"The Unitronics Vision PLC and HMI, programmed through VisiLogic, ships with a hard-coded default administrative password in versions before 9.9.00 that is also used in Vision and Samba controllers and HMIs. An attacker with network access can authenticate with that default password, requiring no prior credentials or user interaction, and take administrative control of the affected system.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:14:07Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.02089,"percentile":0.81557,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-12-11","dueDate":"2023-12-18","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"Note that while it is possible to change the default password, implementors are encouraged to remove affected controllers from public networks and update the affected firmware: https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf;   https://nvd.nist.gov/vuln/detail/CVE-2023-6448","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-11-28","exploitedFirstSeen":"2023-11-28","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems","date":"2023-11-28"},{"url":"https://www.securityweek.com/cisa-warns-of-unitronics-plc-exploitation-following-water-utility-hack/","date":"2023-11-28"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-12-11"},{"url":"https://www.greynoise.io/resources/2023-greynoise-retrospective-internet-exploitation-report","date":"2024-01-16"},{"url":"https://blog.compass-security.com/2024/02/luring-the-threat-lessons-from-custom-ics-honeypots-in-ukraine-and-germany/","date":"2024-02-27"},{"url":"https://www.ptsecurity.com/ww-en/analytics/cybersecurity-threatscape-2023-q4/","date":"2024-03-05"},{"url":"https://www.microsoft.com/en-us/security/blog/2024/05/30/exposed-and-vulnerable-recent-attacks-highlight-critical-need-to-protect-internet-exposed-ot-devices/","date":"2024-05-30"},{"url":"https://www.cisa.gov/sites/default/files/2024-11/aa24-317a-2023-top-routinely-exploited-vulnerabilities.pdf","date":"2024-11-12"},{"url":"https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/2023-top-routinely-exploited-vulnerabilities","date":"2024-11-13"},{"url":"https://www.tenable.com/blog/frequently-asked-questions-about-iranian-cyber-operations","date":"2025-06-27"}],"evidenceTotal":10,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-798","name":"Use of Hard-coded Credentials"},{"id":"CWE-1188","name":"Initialization of a Resource with an Insecure Default"}],"references":[{"url":"https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf","tags":["Vendor Advisory"]},{"url":"https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdf","tags":["Release Notes"]},{"url":"https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.unitronicsplc.com/cyber_security_vision-samba/","tags":["Product"]},{"url":"https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf","tags":["Vendor Advisory"]},{"url":"https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdf","tags":["Release Notes"]},{"url":"https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.unitronicsplc.com/cyber_security_vision-samba/","tags":["Product"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-6448","tags":["US Government Resource"]}],"techniques":[{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: default credentials enable valid account access","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"uses a default administrative password","start":84,"end":122}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1098","name":"Account Manipulation","tactics":["persistence","privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: administrative control implies account privilege changes","mappingType":"primary_impact","evidence":[{"from":"description","quote":"take administrative control of a vulnerable system","start":176,"end":226}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-58685","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-58685","exploited":true,"exploitedSince":"2023-12-11","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1078"],"provenance":"ai"},{"stage":"primary","techniques":["T1098"],"provenance":"ai"}],"timeline":[{"date":"2023-11-28","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems","provenance":"source"},{"date":"2023-12-05","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6448","provenance":"source"},{"date":"2023-12-11","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-12-11","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-58685","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":6},"priority":{"score":61.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1067 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":16.31,"detail":"percentile 0.8156"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}