CVE-2023-6448 is a critical vulnerability affecting Unitronics VisiLogic software, used in Vision and Samba PLCs and HMIs, due to the use of a default administrative password. This allows an unauthenticated attacker with network access to gain full administrative control over vulnerable systems. With a CVSS score of 9.8 (CRITICAL), the vulnerability is easily exploitable remotely with no user interaction, leading to complete compromise of confidentiality, integrity, and availability. This CVE is actively exploited (KEV), has a high FAUCET Risk Score of 99/100, and has garnered significant community discussion and media coverage, despite no public Metasploit or ExploitDB modules.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0, < 9.9.00CPE match | cpe:2.3:a:unitronics:visilogic:*:*:*:*:*:*:*:* | ||
< 12.38CPE matchmatch criteria | cpe:2.3:o:unitronics:vision1210_firmware:*:*:*:*:*:*:*:* | ||
< 12.38CPE matchmatch criteria | cpe:2.3:o:unitronics:vision1040_firmware:*:*:*:*:*:*:*:* | ||
< 12.38CPE matchmatch criteria | cpe:2.3:o:unitronics:vision700_firmware:*:*:*:*:*:*:*:* | ||
< 12.38CPE matchmatch criteria | cpe:2.3:o:unitronics:vision570_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.