Unitronics VisiLogic uses a default administrative password
CVE-2023-6448

9.8CRITICAL

Key Information:

Vendor

Unitronics

Status
Visilogic
Vendor
CVE Published:
5 December 2023

Badges

👾 Exploit Exists🟡 Public PoC🦅 CISA Reported📰 News Worthy

What is CVE-2023-6448?

Unitronics VisiLogic software, crucial for managing Vision and Samba PLCs and HMIs, is vulnerable due to a default administrative password. This flaw permits unauthenticated attackers with network access to gain full administrative control over affected systems, posing significant risks, particularly in sectors reliant on automated systems such as water and wastewater management. It is essential for users to upgrade to version 9.9.00 or later to mitigate this vulnerability. For more information, refer to Unitronics' cybersecurity advisory.

CISA has reported CVE-2023-6448

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2023-6448 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

VisiLogic 0 < 9.9.00

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-6448 - Proof of Concept

News Articles

favicon imageMicrosoft

Exposed and vulnerable: Recent attacks highlight critical need to protect internet-exposed OT devices | Microsoft Security Blog

Since late 2023, Microsoft has observed an increase in reports of attacks focusing on internet-exposed, poorly secured operational technology (OT) devices. Internet-exposed OT equipment in water and wastewater systems (WWS) in the US were targeted in multiple attacks over the past months by differen...

favicon imagePenetration Testing

Hackers attacked US water facility via CVE-2023-6448 vulnerability

CVE-2023-6448 allows unauthenticated attackers with network access to take complete control of the PLC and manipulate critical infrastructure functions

References

https://www.cisa.gov/news-events/alerts/2023/11/28/exploi...
government-resource
https://www.unitronicsplc.com/cyber_security_vision-samba/
https://downloads.unitronicsplc.com/Sites/plc/Visilogic/V...
release-notes

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • 📰

    First article discovered by Penetration Testing

  • 🟡

    Public PoC available

  • Vulnerability published

  • Vulnerability Reserved

.