Unitronics VisiLogic and Vision/Samba PLC Hardcoded Default Administrative Password Vulnerability (CVE-2023-6448) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTUnitronics Vision and Samba PLCs and HMIs configured using VisiLogic versions prior to 9.9.00
Unauthenticated remote attackers with network access can exploit default administrative credentials to gain full control of the target system
Upgrade VisiLogic to version 9.9.00 or later, change default passwords immediately, and restrict external network exposure
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Update the VisiLogic software to version 9.9.00 or later and apply the corresponding firmware updates to the PLC hardware.
# VisiLogic Upgrade Instructions
# 1. Close any running instances of VisiLogic.
# 2. Download and install VisiLogic 9.9.00 or later from the official Unitronics portal:
# URL: https://www.unitronicsplc.com/software-visilogic-for-programmable-controllers/
# 3. Connect to the PLC and perform the recommended OS/Firmware update.2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, isolate the PLC from the public internet and change the default administrative credentials.
# 1. Restrict access to the PCOM port (Default: TCP 20256) using firewall rules.
# Example: Allow only a trusted engineering workstation (e.g., 192.168.1.100) and drop all other traffic.
iptables -A INPUT -p tcp -s 192.168.1.100 --dport 20256 -j ACCEPT
iptables -A INPUT -p tcp --dport 20256 -j DROP
# 2. Open the VisiLogic project, navigate to 'Access Control' settings, and change the default password to a strong, unique credential.3. Log Audit & IoC Verification Commands
Monitor network traffic for unauthorized connections to the PCOM port to detect potential scanning or exploitation attempts.
# Monitor incoming TCP connections on the default PCOM port (20256) using tcpdump
tcpdump -i eth0 'tcp port 20256 and (tcp[tcpflags] & tcp-syn != 0)' -nnStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2023-6448) exists in Unitronics VisiLogic software, which is used to program and configure Vision and Samba PLC and HMI devices. Affected devices ship with a default, hardcoded administrative password (CWE-798, CWE-1188). This design flaw allows any attacker who can establish network connectivity to the device to bypass authentication mechanisms entirely.
2. Exploitation Mechanics & Attack Scenario
An attacker scans the internet using specialized search engines like Shodan or Censys to identify exposed Unitronics PLC devices. Once a target is identified, the attacker initiates a connection via the PCOM protocol or web interface and authenticates using the well-known default administrative credentials. Upon successful authentication, the attacker gains administrative privileges, enabling them to modify ladder logic, stop PLC execution, or manipulate physical processes.
3. Infrastructure & Business Impact
This vulnerability has been actively exploited in the wild, notably targeting Water and Wastewater Systems (WWS) sector organizations, leading to its inclusion in the CISA KEV catalog. Successful exploitation can lead to severe operational disruption, unauthorized physical process manipulation, and potential damage to critical infrastructure assets.
Official Vendor Advisories & References
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.
Frequently Asked SecOps Questions (CVE-2023-6448)
FAQQ1. How critical is CVE-2023-6448 and is it actively exploited in the wild?
CVE-2023-6448 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 2.1%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-6448?
Primary impacted vendors include unitronics across visilogic, vision plc, samba plc. Scope summary: All Unitronics Vision and Samba PLCs/HMIs programmed with VisiLogic versions prior to 9.9.00
Q3. What temporary mitigations or workarounds exist for CVE-2023-6448 before patching?
[Mitigation] Upgrade VisiLogic to version 9.9.00 or later, change default passwords immediately, and restrict external network exposure Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-6448
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (unitronics)
View Category →Arista VeloCloud Orchestrator (VCO) Remote Code Execution and Privilege Escalation (CVE-2026-93952)
[Affected Scope] Arista VeloCloud Orchestrator (VCO) On-premise deployments.
Cisco Identity Services Engine (ISE) Critical Authentication Bypass Vulnerability (CVE-2026-76460)
[Affected Scope] Cisco Identity Services Engine (ISE) web-based management interface and API endpoints.
SonicWall SMA1000 Work Place Pre-Authentication Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-83548)
[Affected Scope] SonicWall SMA1000 Series Appliance Work Place interface
Arista VeloCloud Orchestrator (VCO) On-Premises Remote Code Execution and Privilege Bypass (CVE-2026-16812)
[Affected Scope] On-premises deployments of VeloCloud Orchestrator (VCO)
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.