CVE-2023-6448

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-6448
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf
https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdf
https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems Third Party Advisory US Government Resource
https://www.unitronicsplc.com/cyber_security_vision-samba/
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:unitronics:vision1210_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision1210:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:unitronics:vision1040_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision1040:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:unitronics:vision700_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision700:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:unitronics:vision570_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision570:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:unitronics:vision560_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision560:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:unitronics:vision430_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision430:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:unitronics:vision350_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision350:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:unitronics:vision130_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision130:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:unitronics:vision230_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision230:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:unitronics:vision280_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision280:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:unitronics:vision290_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision290:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:unitronics:vision530_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision530:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:unitronics:vision120_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision120:-:*:*:*:*:*:*:*
History

19 Dec 2023, 14:15

Type Values Removed Values Added
References
  • () https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf -

13 Dec 2023, 17:15

Type Values Removed Values Added
Summary (en) Unitronics Vision Series PLCs and HMIs use default administrative passwords. An unauthenticated attacker with network access to a PLC or HMI can take administrative control of the system. (en) Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.

13 Dec 2023, 15:15

Type Values Removed Values Added
References
  • () https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdf -
  • () https://www.unitronicsplc.com/cyber_security_vision-samba/ -

12 Dec 2023, 15:31

Type Values Removed Values Added
First Time Unitronics vision230 Firmware
Unitronics vision700 Firmware
Unitronics vision700
Unitronics vision130
Unitronics vision230
Unitronics vision280
Unitronics vision120 Firmware
Unitronics
Unitronics vision1040 Firmware
Unitronics vision120
Unitronics vision560
Unitronics vision530 Firmware
Unitronics vision1040
Unitronics vision350 Firmware
Unitronics vision1210 Firmware
Unitronics vision350
Unitronics vision290 Firmware
Unitronics vision290
Unitronics vision570
Unitronics vision560 Firmware
Unitronics vision430
Unitronics vision1210
Unitronics vision530
Unitronics vision570 Firmware
Unitronics vision280 Firmware
Unitronics vision130 Firmware
Unitronics vision430 Firmware
CWE CWE-798
CPE cpe:2.3:o:unitronics:vision1040_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision560_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision1210:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision120:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision1040:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision570_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision430:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision700:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision120_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision570:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision230:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision230_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision700_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision280_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision530_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision530:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision350:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision130_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision1210_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision430_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision350_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision290_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision130:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision290:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision280:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision560:-:*:*:*:*:*:*:*
References () https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems - () https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems - Third Party Advisory, US Government Resource

05 Dec 2023, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-05 18:15

Updated : 2023-12-19 14:15

NVD link : CVE-2023-6448

Mitre link : CVE-2023-6448

CVE.ORG link : CVE-2023-6448

JSON object : View

Products Affected

unitronics

  • vision1210_firmware
  • vision1040_firmware
  • vision350_firmware
  • vision570_firmware
  • vision430
  • vision290_firmware
  • vision560_firmware
  • vision430_firmware
  • vision560
  • vision130
  • vision290
  • vision570
  • vision280_firmware
  • vision130_firmware
  • vision530_firmware
  • vision350
  • vision230_firmware
  • vision1210
  • vision530
  • vision1040
  • vision700
  • vision230
  • vision120_firmware
  • vision700_firmware
  • vision120
  • vision280
CWE
CWE-798

Use of Hard-coded Credentials

CWE-1188

Insecure Default Initialization of Resource