CVE-2023-6448
05.12.2023, 18:15
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.Enginsight
| Vendor | Product | Version |
|---|---|---|
| unitronics | vision1210_firmware | 𝑥 < 12.38 |
| unitronics | vision1040_firmware | 𝑥 < 12.38 |
| unitronics | vision700_firmware | 𝑥 < 12.38 |
| unitronics | vision570_firmware | 𝑥 < 12.38 |
| unitronics | vision560_firmware | 𝑥 < 12.38 |
| unitronics | vision430_firmware | 𝑥 < 12.38 |
| unitronics | vision350_firmware | 𝑥 < 12.38 |
| unitronics | vision130_firmware | 𝑥 < 12.38 |
| unitronics | vision230_firmware | 𝑥 < 12.38 |
| unitronics | vision280_firmware | 𝑥 < 12.38 |
| unitronics | vision290_firmware | 𝑥 < 12.38 |
| unitronics | vision530_firmware | 𝑥 < 12.38 |
| unitronics | vision120_firmware | 𝑥 < 12.38 |
| unitronics | visilogic | 𝑥 < 9.9.00 |
| unitronics | samba_3.5_firmware | 𝑥 < 12.38 |
| unitronics | samba_4.3_firmware | 𝑥 < 12.38 |
| unitronics | samba_7_firmware | 𝑥 < 12.38 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-1188 - Insecure Default Initialization of ResourceThe software initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.
- CWE-798 - Use of Hard-coded CredentialsThe software contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
References