CVE-2023-6448

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1188 CWE-798

Affected software

Vendor	Product	Versions
Unitronics	VisiLogic	< 9.9.00
unitronics	visilogic	< 9.9.00

References

https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdfVendor Advisory
https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdfRelease Notes
https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systemsThird Party Advisory, US Government Resource
https://www.unitronicsplc.com/cyber_security_vision-samba/Product
https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdfVendor Advisory
https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdfRelease Notes
https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systemsThird Party Advisory, US Government Resource
https://www.unitronicsplc.com/cyber_security_vision-samba/Product
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-6448US Government Resource

Timeline

Published: Dec 5, 2023
Last modified: Jun 17, 2026
Added to CISA KEV: Dec 11, 2023
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-64497.2The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'validate' f CVE-2023-64505.5An incorrect permissions vulnerability was reported in the Lenovo App Store app that could allow an attacker to use system resources, result CVE-2023-64517.5Publicly known cryptographic machine key in AlayaCare's Procura Portal before 9.0.1.2 allows attackers to forge their own authentication coo CVE-2023-64529.6Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Web Security (Transaction V CVE-2023-64564.8The WP Review Slider WordPress plugin before 13.0 does not sanitise and escape some of its settings, which could allow high privilege users CVE-2023-64577.1Incorrect Default Permissions vulnerability in Hitachi Tuning Manager on Windows (Hitachi Tuning Manager server component) allows local user CVE-2023-64589.8Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perform a client-side pa CVE-2023-64595.3Mattermost is grouping calls in the /metrics endpoint by id and reports that id in the response. Since this id is the channelID, the public CVE-2023-64605.5A potential logging of the firestore key via logging within nodejs-firestore exists - Developers who were logging objects through this._sett CVE-2023-64616.1Cross-site Scripting (XSS) - Reflected in GitHub repository viliusle/minipaint prior to 4.14.0.CVE-2023-64626.1A vulnerability, which was classified as problematic, was found in SourceCodester User Registration and Login System 1.0. Affected is an unk CVE-2023-64635.4A vulnerability has been found in SourceCodester User Registration and Login System 1.0 and classified as problematic. Affected by this vuln