Unitronics Vision PLC and HMI Insecure Default Password Vulnerability (CVE-2023-6448)

A remote attacker, without authentication, can achieve full data confidentiality loss, arbitrary modification of data, complete denial of service or system unavailability. Federal agencies are required to remediate by 2023-12-18 under CISA BOD 22-01.

This is a Insecure Default Initialization of Resource (CWE-1188) vulnerability in Unitronics Vision PLC and HMI. Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system. Exploitation requires remote network access, low attack complexity, no authentication required, and no user interaction required.

Probably yes if any of these apply:

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2023-12-11 based on evidence of active exploitation in the wild. Federal agencies required to remediate by 2023-12-18.