# CVE-2023-6448

Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.

- Page: https://www.vulneraibility.com/cve/CVE-2023-6448
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2023-12-11; CISA due date 2023-12-18
- EPSS: 2.09% (percentile 81.8)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2023-12-06)
- Weakness: CWE-1188
- Published: 2023-12-05

## Affected versions

- Unitronics VisiLogic: affected < 9.9.00

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems
- [other] https://www.unitronicsplc.com/cyber_security_vision-samba/
- [other] https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdf
- [advisory] https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-6448

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.