CVE-2023-6448

UNKNOWNKnown Exploited

CISA Known Exploited Vulnerability

Note that while it is possible to change the default password, implementors are encouraged to remove affected controllers from public networks and update the affected firmware: https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf; https://nvd.nist.gov/vuln/detail/CVE-2023-6448

Remediation deadline: December 18, 2023

Description

Unitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute remote commands.

Timeline

Published:December 11th, 2023 12:00 AM

Last modified:December 11th, 2023 12:00 AM

Added to KEV:December 11th, 2023

CVSS Scoring

No CVSS v3 score available

Affected Software

From NVD CPE configuration data

Vendors

Unitronics

Products

Vision PLC and HMI

Weaknesses (CWE)

CWE-1188

References & Reports

Advisories, patches, and third-party reports

No references available.

Source: CISA KEV + NVD · Data may lag official sources by up to one minute