CVE-2023-6448Unitronics VisiLogic uses a default administrative password
Updated under an hour ago ()
Does this affect you?
It affects Unitronics VisiLogic and 16 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Dec 11, 2023; federal agencies had to remediate by Dec 18, 2023. Treat that date as your deadline.
Do this next
Free account, 1 product
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-1188
- Known exploited
- Added to CISA KEV Dec 11, 2023; federal remediation due Dec 18, 2023Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- EPSS (exploitation in the next 30 days)
- 2.09% (percentile 81)
- Assigned by
- cisa-cg
- NVD analysis
- Analyzed
- Record last updated
- Oct 21, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Unitronics VisiLogic unitronics:visilogic (from the name) | before 9.9.00 | CNA record |
unitronics visilogic unitronics:visilogic | before 9.9.00 | CISA ADP |
unitronics vision1210_firmware unitronics:vision1210_firmware | before 12.38 | NVD |
unitronics vision1040_firmware unitronics:vision1040_firmware | before 12.38 | NVD |
unitronics vision700_firmware unitronics:vision700_firmware | before 12.38 | NVD |
unitronics vision570_firmware unitronics:vision570_firmware | before 12.38 | NVD |
unitronics vision560_firmware unitronics:vision560_firmware | before 12.38 | NVD |
unitronics vision430_firmware unitronics:vision430_firmware | before 12.38 | NVD |
unitronics vision350_firmware unitronics:vision350_firmware | before 12.38 | NVD |
unitronics vision130_firmware unitronics:vision130_firmware | before 12.38 | NVD |
unitronics vision230_firmware unitronics:vision230_firmware | before 12.38 | NVD |
unitronics vision280_firmware unitronics:vision280_firmware | before 12.38 | NVD |
unitronics vision290_firmware unitronics:vision290_firmware | before 12.38 | NVD |
unitronics vision530_firmware unitronics:vision530_firmware | before 12.38 | NVD |
unitronics vision120_firmware unitronics:vision120_firmware | before 12.38 | NVD |
unitronics visilogic unitronics:visilogic | before 9.9.00 | NVD |
unitronics samba_3.5_firmware unitronics:samba_3.5_firmware | before 12.38 | NVD |
unitronics samba_4.3_firmware unitronics:samba_4.3_firmware | before 12.38 | NVD |
unitronics samba_7_firmware unitronics:samba_7_firmware | before 12.38 | NVD |
References
- https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systemsgovernment-resource, third-party-advisory, us-government-resource
- https://www.unitronicsplc.com/cyber_security_vision-samba/product
- https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdfrelease-notes
- https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdfvendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-6448us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.