CVE-2023-6448

Unitronics VisiLogic software before version 9.9.00, which runs on Vision and Samba PLCs and HMIs, ships with a default administrative password that many deployments never change. An unauthenticated attacker with network access to the device can authenticate with these default credentials, requiring no exploit development or user interaction. A successful login grants full administrative control of the PLC/HMI, allowing the attacker to modify configuration and program logic and potentially disrupt the physical process (such as water treatment and distribution) the device controls. Any deployment of the listed Unitronics Vision models (and, per CISA's description, Samba devices) running VisiLogic prior to 9.9.00 is affected, with the greatest risk for units directly exposed to the internet at utilities and small industrial sites. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-12-11, indicating confirmed exploitation in the wild, and CISA has urged water facilities to secure their Unitronics PLCs.

What to do: Upgrade to VisiLogic 9.9.00 or later and set a strong, unique administrative password on every Vision/Samba device. Restrict network access to affected devices (firewall or VPN rather than direct internet exposure) and review device logs for unexpected administrative logins. Per the CISA KEV required action, apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.