CVE-2023-6448 - Unitronics Vision PLC and HMI Insecure Default Password Vulnerability
Unitronics | Vision PLC and HMI
- Date Added:
- 2023-12-11
- Due Date:
- 2023-12-18
- Vulnerability Name
Unitronics Vision PLC and HMI Insecure Default Password Vulnerability
- Description
Unitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute remote commands.
- Known To Be Used in Ransomware Campaigns?
Unknown
- Action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Additional Notes
- Note that while it is possible to change the default password, implementors are encouraged to remove affected controllers from public networks and update the affected firmware: https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf; https://nvd.nist.gov/vuln/detail/CVE-2023-6448
Free online web security scanner