Read the docs
TI-2023-05916 Aliases CVE-2023-6448GHSA-3r8p-3x67-72v8

Unitronics VisiLogic uses a default administrative password

Priority CRITICAL 100Exploited in the wildCWE-1188Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-798.

Summary

Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.

Why it matters now

Exploitation Active In CISA KEV since 2023-12-11CISA due date 2023-12-18
EPSS 0.02089 81st percentileScored 2026-11-07
Fix Fixed VisiLogic (Unitronics): 9.9.00

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnitronicsVisiLogicbefore 9.9.009.9.00Patch availableCNA
  • VisiLogic VendorUnitronics Affected before 9.9.00 Fixed in 9.9.00 Patch available CNA

CPE configurations NVD · 33

CPEVersionsRoleVendor
cpe:2.3:o:unitronics:vision1210_firmware:*:*:*:*:*:*:*:*before 12.38VulnerableUnitronics
cpe:2.3:h:unitronics:vision1210:-:*:*:*:*:*:*:*not specified by NVDRunning onUnitronics
cpe:2.3:o:unitronics:vision1040_firmware:*:*:*:*:*:*:*:*before 12.38VulnerableUnitronics
cpe:2.3:h:unitronics:vision1040:-:*:*:*:*:*:*:*not specified by NVDRunning onUnitronics
cpe:2.3:o:unitronics:vision700_firmware:*:*:*:*:*:*:*:*before 12.38VulnerableUnitronics
cpe:2.3:h:unitronics:vision700:-:*:*:*:*:*:*:*not specified by NVDRunning onUnitronics
cpe:2.3:o:unitronics:vision570_firmware:*:*:*:*:*:*:*:*before 12.38VulnerableUnitronics
cpe:2.3:h:unitronics:vision570:-:*:*:*:*:*:*:*not specified by NVDRunning onUnitronics
cpe:2.3:o:unitronics:vision560_firmware:*:*:*:*:*:*:*:*before 12.38VulnerableUnitronics
cpe:2.3:h:unitronics:vision560:-:*:*:*:*:*:*:*not specified by NVDRunning onUnitronics
  • cpe:2.3:o:unitronics:vision1210_firmware:*:*:*:*:*:*:*:* Versions before 12.38 Vulnerable ·Unitronics
  • cpe:2.3:h:unitronics:vision1210:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Unitronics
  • cpe:2.3:o:unitronics:vision1040_firmware:*:*:*:*:*:*:*:* Versions before 12.38 Vulnerable ·Unitronics
  • cpe:2.3:h:unitronics:vision1040:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Unitronics
  • cpe:2.3:o:unitronics:vision700_firmware:*:*:*:*:*:*:*:* Versions before 12.38 Vulnerable ·Unitronics
  • cpe:2.3:h:unitronics:vision700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Unitronics
  • cpe:2.3:o:unitronics:vision570_firmware:*:*:*:*:*:*:*:* Versions before 12.38 Vulnerable ·Unitronics
  • cpe:2.3:h:unitronics:vision570:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Unitronics
  • cpe:2.3:o:unitronics:vision560_firmware:*:*:*:*:*:*:*:* Versions before 12.38 Vulnerable ·Unitronics
  • cpe:2.3:h:unitronics:vision560:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Unitronics
Show 23 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:unitronics:vision430_firmware:*:*:*:*:*:*:*:*before 12.38VulnerableUnitronics
cpe:2.3:h:unitronics:vision430:-:*:*:*:*:*:*:*not specified by NVDRunning onUnitronics
cpe:2.3:o:unitronics:vision350_firmware:*:*:*:*:*:*:*:*before 12.38VulnerableUnitronics
cpe:2.3:h:unitronics:vision350:-:*:*:*:*:*:*:*not specified by NVDRunning onUnitronics
cpe:2.3:o:unitronics:vision130_firmware:*:*:*:*:*:*:*:*before 12.38VulnerableUnitronics
cpe:2.3:h:unitronics:vision130:-:*:*:*:*:*:*:*not specified by NVDRunning onUnitronics
cpe:2.3:o:unitronics:vision230_firmware:*:*:*:*:*:*:*:*before 12.38VulnerableUnitronics
cpe:2.3:h:unitronics:vision230:-:*:*:*:*:*:*:*not specified by NVDRunning onUnitronics
cpe:2.3:o:unitronics:vision280_firmware:*:*:*:*:*:*:*:*before 12.38VulnerableUnitronics
cpe:2.3:h:unitronics:vision280:-:*:*:*:*:*:*:*not specified by NVDRunning onUnitronics
cpe:2.3:o:unitronics:vision290_firmware:*:*:*:*:*:*:*:*before 12.38VulnerableUnitronics
cpe:2.3:h:unitronics:vision290:-:*:*:*:*:*:*:*not specified by NVDRunning onUnitronics
cpe:2.3:o:unitronics:vision530_firmware:*:*:*:*:*:*:*:*before 12.38VulnerableUnitronics
cpe:2.3:h:unitronics:vision530:-:*:*:*:*:*:*:*not specified by NVDRunning onUnitronics
cpe:2.3:o:unitronics:vision120_firmware:*:*:*:*:*:*:*:*before 12.38VulnerableUnitronics
cpe:2.3:h:unitronics:vision120:-:*:*:*:*:*:*:*not specified by NVDRunning onUnitronics
cpe:2.3:a:unitronics:visilogic:*:*:*:*:*:*:*:*before 9.9.00VulnerableUnitronics
cpe:2.3:o:unitronics:samba_3.5_firmware:*:*:*:*:*:*:*:*before 12.38VulnerableUnitronics
cpe:2.3:h:unitronics:samba_3.5:-:*:*:*:*:*:*:*not specified by NVDRunning onUnitronics
cpe:2.3:o:unitronics:samba_4.3_firmware:*:*:*:*:*:*:*:*before 12.38VulnerableUnitronics
cpe:2.3:h:unitronics:samba_4.3:-:*:*:*:*:*:*:*not specified by NVDRunning onUnitronics
cpe:2.3:o:unitronics:samba_7_firmware:*:*:*:*:*:*:*:*before 12.38VulnerableUnitronics
cpe:2.3:h:unitronics:samba_7:-:*:*:*:*:*:*:*not specified by NVDRunning onUnitronics
  • cpe:2.3:o:unitronics:vision430_firmware:*:*:*:*:*:*:*:* Versions before 12.38 Vulnerable ·Unitronics
  • cpe:2.3:h:unitronics:vision430:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Unitronics
  • cpe:2.3:o:unitronics:vision350_firmware:*:*:*:*:*:*:*:* Versions before 12.38 Vulnerable ·Unitronics
  • cpe:2.3:h:unitronics:vision350:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Unitronics
  • cpe:2.3:o:unitronics:vision130_firmware:*:*:*:*:*:*:*:* Versions before 12.38 Vulnerable ·Unitronics
  • cpe:2.3:h:unitronics:vision130:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Unitronics
  • cpe:2.3:o:unitronics:vision230_firmware:*:*:*:*:*:*:*:* Versions before 12.38 Vulnerable ·Unitronics
  • cpe:2.3:h:unitronics:vision230:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Unitronics
  • cpe:2.3:o:unitronics:vision280_firmware:*:*:*:*:*:*:*:* Versions before 12.38 Vulnerable ·Unitronics
  • cpe:2.3:h:unitronics:vision280:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Unitronics
  • cpe:2.3:o:unitronics:vision290_firmware:*:*:*:*:*:*:*:* Versions before 12.38 Vulnerable ·Unitronics
  • cpe:2.3:h:unitronics:vision290:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Unitronics
  • cpe:2.3:o:unitronics:vision530_firmware:*:*:*:*:*:*:*:* Versions before 12.38 Vulnerable ·Unitronics
  • cpe:2.3:h:unitronics:vision530:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Unitronics
  • cpe:2.3:o:unitronics:vision120_firmware:*:*:*:*:*:*:*:* Versions before 12.38 Vulnerable ·Unitronics
  • cpe:2.3:h:unitronics:vision120:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Unitronics
  • cpe:2.3:a:unitronics:visilogic:*:*:*:*:*:*:*:* Versions before 9.9.00 Vulnerable ·Unitronics
  • cpe:2.3:o:unitronics:samba_3.5_firmware:*:*:*:*:*:*:*:* Versions before 12.38 Vulnerable ·Unitronics
  • cpe:2.3:h:unitronics:samba_3.5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Unitronics
  • cpe:2.3:o:unitronics:samba_4.3_firmware:*:*:*:*:*:*:*:* Versions before 12.38 Vulnerable ·Unitronics
  • cpe:2.3:h:unitronics:samba_4.3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Unitronics
  • cpe:2.3:o:unitronics:samba_7_firmware:*:*:*:*:*:*:*:* Versions before 12.38 Vulnerable ·Unitronics
  • cpe:2.3:h:unitronics:samba_7:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Unitronics

Remediation

  • Fix · CNA VisiLogic (Unitronics) Fixed in 9.9.00

Timeline

  1. 2023-12-11 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2023-6448
  3. 2026-10-03 Alias added: GHSA-3r8p-3x67-72v8

References

Advisory 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences