CVE-2023-6448: Unitronics VisiLogic default admin password in Vision and Samba PLCs/HMIs

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, confirmed exploitation in the wild, and CISA KEV listing make this an urgent patch-or-isolate case.

What it is

Unitronics VisiLogic before 9.9.00, used with Vision and Samba PLCs and HMIs, ships with a default administrative password. Because the credential is fixed and predictable, anyone who can reach the device on the network can log in as administrator without prior access. This affects operational technology used in industrial and water/wastewater environments, where administrative control of a PLC or HMI can disrupt physical processes.

Impact

An unauthenticated attacker gains full administrative control of the affected PLC or HMI, including configuration changes and manipulation of controlled processes. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reachable over the network (AV:N) with no privileges and no user interaction required (PR:N, UI:N), so any host that can route to the device's management interface can attempt the default credentials. No authentication is needed because the flaw is the credential itself.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2023-12-11 and issued an alert about exploitation against Unitronics PLCs in water and wastewater systems. EPSS 30-day probability is about 2.1 percent (80th percentile), and no ransomware campaign use is recorded.

What to do

• Upgrade VisiLogic to 9.9.00 or later and apply the vendor's advisory guidance to affected Vision and Samba devices.
• Change the default administrative password on every exposed PLC and HMI, and remove or disable unused accounts.
• Remove internet exposure of PLC/HMI management interfaces; place them behind a firewall or VPN with strict allowlists.
• Segment OT networks from IT and business networks, and restrict access to the programming and web interfaces to authorized engineering hosts.
• If the vendor mitigation cannot be applied, follow CISA's guidance to discontinue use of the affected product.

Detection

• Monitor PLC/HMI management interfaces for successful logins using default or shared administrative credentials, especially from unexpected source addresses.
• Alert on configuration or program changes to Vision and Samba devices outside approved engineering windows.
• Watch for new or unusual network connections to PLC/HMI management ports from IT or internet-facing segments.
• Review authentication logs and device change logs for repeated failed logins followed by a success, which can indicate credential guessing.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.