← Vulnerability Intelligence

CVE-2023-6448

Critical 9.8 Exploited in the wild (KEV)

Confirmed active exploitation — CISA KEV catalog

Name
Unitronics Vision PLC and HMI Insecure Default Password Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.

Metrics

CVSS 3.1
9.8 (CRITICAL) Score source: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS — exploit probability
2% (percentile: 82) as of 2 November 2026
CWE
CWE-1188, CWE-798

Affected products

unitronics: vision1210 firmware; unitronics: vision1210; unitronics: vision1040 firmware; unitronics: vision1040; unitronics: vision700 firmware; unitronics: vision700; unitronics: vision570 firmware; unitronics: vision570; unitronics: vision560 firmware; unitronics: vision560; unitronics: vision430 firmware; unitronics: vision430; unitronics: vision350 firmware; unitronics: vision350; unitronics: vision130 firmware

References