CVE-2023-6448

What it actually does

Unitronics VisiLogic versions before 9.9.00 use a default administrative password for Vision and Samba PLC/HMI systems. If the device management interface is reachable over a network, an unauthenticated attacker can authenticate with the known default credential and obtain administrative control. Successful exploitation can allow configuration changes, logic/program manipulation, device reset or stop/start operations, data access, and disruption of PLC/HMI-controlled processes. The CVSS 9.8 rating reflects network exploitation with low complexity, no required privileges, no user interaction, and potential full confidentiality, integrity, and availability impact.

Why it matters to the business

Exploitation can give an external attacker control over industrial automation equipment used to monitor or control physical processes. This can lead to operational downtime, unsafe process behavior, loss of visibility from HMI panels, unauthorized changes to PLC logic, production disruption, incident response costs, and potential safety or regulatory consequences. The vulnerability is listed in CISA KEV with a remediation deadline of 2023-12-18 and is known to be exploited in the wild, so internet-exposed or poorly segmented Unitronics deployments should be treated as high-priority operational technology risk even though the EPSS score is modest.

How an attack unfolds

An attacker first identifies Unitronics Vision or Samba PLC/HMI devices exposed on the internet, reachable through remote access paths, or accessible from a compromised internal network segment. They connect to the device’s management/programming service and attempt authentication using the known default administrative password present in vulnerable VisiLogic deployments before version 9.9.00. If the credential has not been changed or the vulnerable software behavior remains present, the attacker gains administrative access without needing a valid account from the organization. From there, they can inspect configuration, upload or modify logic, change HMI settings, stop or restart equipment, alter communications parameters, or use the device as a foothold for additional OT network reconnaissance. Public exploitation has been observed, and defenders should assume exposed systems may have been probed or accessed.

How to fix it

Upgrade Unitronics VisiLogic to version 9.9.00 or later and apply any vendor-recommended firmware or project updates for affected Vision and Samba PLCs/HMIs. Change all default administrative passwords to unique, strong credentials and verify that no shared factory-default or reused passwords remain. Remove PLC/HMI management interfaces from direct internet exposure and restrict access to trusted engineering workstations through VPN, jump hosts, firewall allowlists, and OT network segmentation. Disable unused services and remote access paths where possible. Review all PLC/HMI programs, project files, user settings, and communications configurations for unauthorized changes before returning critical equipment to normal operation.

How to confirm the fix worked

Confirm that VisiLogic is version 9.9.00 or later on engineering systems and that affected Unitronics PLC/HMI projects have been updated according to vendor guidance. Attempt to authenticate using the former default administrative password from an isolated, authorized test host; the attempt should fail. Validate that management and programming services are not reachable from the public internet and are only accessible from approved engineering network segments. Run external and internal scans to identify exposed Unitronics services, then compare results against approved asset inventories. Review device configuration backups before and after remediation to confirm that credentials, logic, and communications settings are expected.

Typical attack path

1. Scan internet-facing or reachable OT network ranges for Unitronics Vision or Samba PLC/HMI services.
2. Fingerprint the device model, firmware, or VisiLogic-accessible interface.
3. Attempt login using the known default administrative password.
4. Gain administrative access to the PLC/HMI without prior authorization.
5. Download project/configuration data or enumerate device settings.
6. Modify logic, HMI screens, communications settings, or operating state.
7. Disrupt the controlled process, hide changes from operators, or pivot further into the OT environment.

How to detect it

Look for evidence of unauthorized access to Unitronics PLC/HMI management or programming interfaces. Useful sources include PLC/HMI event logs where available, VisiLogic engineering workstation logs, firewall and VPN logs, remote access gateway logs, IDS/IPS telemetry, asset discovery records, NetFlow, packet captures from OT network sensors, and configuration management backups. Investigate successful or repeated login attempts to Unitronics devices from unfamiliar IP addresses, especially over management or programming ports; unexpected project uploads/downloads; changes to ladder logic, HMI screens, communications settings, or passwords; device stop/start/reset events; and new or unusual connections between IT networks and OT segments. Since this flaw involves default administrative credentials, exploitation may look like a normal successful administrator login unless correlated with source, timing, and change activity. Compare current device projects and settings against trusted backups, and review activity since public disclosure on 2023-12-05, with heightened concern for any internet-exposed devices before remediation.

• VisiLogic.exe
• Unitronics VisiLogic
• Unitronics
• Vision1210
• Vision1040
• Vision700
• Vision570
• Vision560
• Vision430
• Vision350
• Vision130
• Vision230
• Vision280
• Vision290
• Vision530
• Samba
• Project upload
• Project download
• PLC Stop
• PLC Start
• PLC Reset
• password changed
• login successful
• login failed

What your security team should do

• Immediately identify all Unitronics Vision and Samba PLC/HMI assets, including engineering workstations using VisiLogic, and determine whether any are reachable from the internet or untrusted networks.
• Prioritize remediation for internet-exposed systems, safety-critical processes, and devices supporting production or utilities operations.
• Upgrade VisiLogic to 9.9.00 or later and apply vendor guidance for affected PLC/HMI deployments.
• Change all default administrative passwords and enforce unique credentials for each device or site.
• Restrict management access using OT segmentation, firewall allowlists, VPN or jump-host controls, and monitoring of engineering workstation access.
• Hunt for prior exploitation by reviewing authentication, configuration-change, project-upload/download, and device restart/stop events around and after the 2023-12-05 publication date.
• Compare running PLC/HMI logic and configurations against known-good backups to identify unauthorized modifications.
• Because this vulnerability is in the CISA KEV catalog and exploitation is active in the wild, treat missed remediation as an urgent governance and operational risk item even if no ransomware association is currently listed.