CVE-2023-6448

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-6448
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf Vendor Advisory
https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdf Release Notes
https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems Third Party Advisory US Government Resource
https://www.unitronicsplc.com/cyber_security_vision-samba/ Product
https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf Vendor Advisory
https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdf Release Notes
https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems Third Party Advisory US Government Resource
https://www.unitronicsplc.com/cyber_security_vision-samba/ Product
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:unitronics:vision1210_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision1210:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:unitronics:vision1040_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision1040:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:unitronics:vision700_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision700:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:unitronics:vision570_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision570:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:unitronics:vision560_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision560:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:unitronics:vision430_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision430:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:unitronics:vision350_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision350:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:unitronics:vision130_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision130:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:unitronics:vision230_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision230:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:unitronics:vision280_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision280:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:unitronics:vision290_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision290:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:unitronics:vision530_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision530:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:unitronics:vision120_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision120:-:*:*:*:*:*:*:*

Configuration 14 (hide)

cpe:2.3:a:unitronics:visilogic:*:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
cpe:2.3:o:unitronics:samba_3.5_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:samba_3.5:-:*:*:*:*:*:*:*

Configuration 16 (hide)

AND
cpe:2.3:o:unitronics:samba_4.3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:samba_4.3:-:*:*:*:*:*:*:*

Configuration 17 (hide)

AND
cpe:2.3:o:unitronics:samba_7_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:samba_7:-:*:*:*:*:*:*:*
History

21 Nov 2024, 08:43

Type Values Removed Values Added
References () https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf - Vendor Advisory () https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf - Vendor Advisory
References () https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdf - Release Notes () https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdf - Release Notes
References () https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems - Third Party Advisory, US Government Resource () https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems - Third Party Advisory, US Government Resource
References () https://www.unitronicsplc.com/cyber_security_vision-samba/ - Product () https://www.unitronicsplc.com/cyber_security_vision-samba/ - Product

26 Jun 2024, 19:59

Type Values Removed Values Added
CPE cpe:2.3:o:unitronics:vision290_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision230_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision700_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision280_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision1210_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision120_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision570_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision130_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision1040_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision350_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision530_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision560_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision430_firmware:-:*:*:*:*:*:*:*		 cpe:2.3:o:unitronics:vision290_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision700_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:samba_3.5_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision350_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision530_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision1210_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision120_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:samba_7:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:samba_7_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:samba_3.5:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision570_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:samba_4.3:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision1040_firmware:*:*:*:*:*:*:*:*
cpe:2.3:a:unitronics:visilogic:*:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision560_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:samba_4.3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision280_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision430_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision130_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision230_firmware:*:*:*:*:*:*:*:*
First Time Unitronics samba 3.5
Unitronics samba 7
Unitronics samba 7 Firmware
Unitronics visilogic
Unitronics samba 4.3
Unitronics samba 4.3 Firmware
Unitronics samba 3.5 Firmware
References () https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf - () https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf - Vendor Advisory
References () https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdf - () https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdf - Release Notes
References () https://www.unitronicsplc.com/cyber_security_vision-samba/ - () https://www.unitronicsplc.com/cyber_security_vision-samba/ - Product

19 Dec 2023, 14:15

Type Values Removed Values Added
References
  • () https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf -

13 Dec 2023, 17:15

Type Values Removed Values Added
Summary Unitronics Vision Series PLCs and HMIs use default administrative passwords. An unauthenticated attacker with network access to a PLC or HMI can take administrative control of the system. Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.

13 Dec 2023, 15:15

Type Values Removed Values Added
References
  • () https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdf -
  • () https://www.unitronicsplc.com/cyber_security_vision-samba/ -

12 Dec 2023, 15:31

Type Values Removed Values Added
CWE CWE-798
References () https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems - () https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems - Third Party Advisory, US Government Resource
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
First Time Unitronics vision530 Firmware
Unitronics vision130
Unitronics vision700 Firmware
Unitronics vision530
Unitronics vision700
Unitronics vision350
Unitronics vision430 Firmware
Unitronics vision570
Unitronics vision560
Unitronics vision350 Firmware
Unitronics vision570 Firmware
Unitronics vision290 Firmware
Unitronics vision280
Unitronics vision1040
Unitronics vision280 Firmware
Unitronics vision230
Unitronics vision560 Firmware
Unitronics vision1210 Firmware
Unitronics vision130 Firmware
Unitronics vision430
Unitronics vision1040 Firmware
Unitronics vision1210
Unitronics vision120
Unitronics vision120 Firmware
Unitronics vision290
Unitronics
Unitronics vision230 Firmware
CPE cpe:2.3:o:unitronics:vision350_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision1210:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision1210_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision350:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision1040:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision430:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision230_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision290_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision570_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision700:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision280_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision1040_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision570:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision560:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision430_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision530:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision130_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision560_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision530_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision290:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision130:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision280:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision120:-:*:*:*:*:*:*:*
cpe:2.3:h:unitronics:vision230:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision120_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:unitronics:vision700_firmware:-:*:*:*:*:*:*:*

05 Dec 2023, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-05 18:15

Updated : 2025-01-27 21:52

NVD link : CVE-2023-6448

Mitre link : CVE-2023-6448

CVE.ORG link : CVE-2023-6448

JSON object : View

Products Affected

unitronics

  • vision530
  • vision350
  • vision1040_firmware
  • vision280
  • vision350_firmware
  • vision560_firmware
  • vision700_firmware
  • vision570_firmware
  • samba_7
  • vision430_firmware
  • vision1040
  • samba_3.5
  • vision560
  • vision290
  • samba_4.3
  • vision130
  • vision530_firmware
  • samba_4.3_firmware
  • vision230_firmware
  • visilogic
  • vision290_firmware
  • vision280_firmware
  • vision130_firmware
  • vision120
  • vision1210_firmware
  • vision570
  • vision1210
  • samba_7_firmware
  • vision120_firmware
  • vision700
  • samba_3.5_firmware
  • vision230
  • vision430
CWE
CWE-1188

Insecure Default Initialization of Resource

CWE-798

Use of Hard-coded Credentials