Lucene search

9119a7d8-5eab-497f-8521-727c672e3725NVD:CVE-2023-6448

HistoryDec 05, 2023 - 6:15 p.m.

CVE-2023-6448

2023-12-0518:15:12

CWE-798

CWE-1188

9119a7d8-5eab-497f-8521-727c672e3725

web.nvd.nist.gov

unitronics

visilogic

default password

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.039 Low

EPSS

Percentile

92.1%

JSON

Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.

Affected configurations

NVD

Node

unitronicsvision1210_firmwareRange<12.38

AND

unitronicsvision1210Match-

Node

unitronicsvision1040_firmwareRange<12.38

AND

unitronicsvision1040Match-

Node

unitronicsvision700_firmwareRange<12.38

AND

unitronicsvision700Match-

Node

unitronicsvision570_firmwareRange<12.38

AND

unitronicsvision570Match-

Node

unitronicsvision560_firmwareRange<12.38

AND

unitronicsvision560Match-

Node

unitronicsvision430_firmwareRange<12.38

AND

unitronicsvision430Match-

Node

unitronicsvision350_firmwareRange<12.38

AND

unitronicsvision350Match-

Node

unitronicsvision130_firmwareRange<12.38

AND

unitronicsvision130Match-

Node

unitronicsvision230_firmwareRange<12.38

AND

unitronicsvision230Match-

Node

unitronicsvision280_firmwareRange<12.38

AND

unitronicsvision280Match-

Node

unitronicsvision290_firmwareRange<12.38

AND

unitronicsvision290Match-

Node

unitronicsvision530_firmwareRange<12.38

AND

unitronicsvision530Match-

Node

unitronicsvision120_firmwareRange<12.38

AND

unitronicsvision120Match-

Node

unitronicsvisilogicRange<9.9.00

Node

unitronicssamba_3.5_firmwareRange<12.38

AND

unitronicssamba_3.5Match-

Node

unitronicssamba_4.3_firmwareRange<12.38

AND

unitronicssamba_4.3Match-

Node

unitronicssamba_7_firmwareRange<12.38

AND

unitronicssamba_7Match-

References

downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf

downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdf

www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems

www.unitronicsplc.com/cyber_security_vision-samba/

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.039 Low

EPSS

Percentile

92.1%

JSON

Related for NVD:CVE-2023-6448