CVE-2023-6448

Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.

Scoring

Severity

CRITICAL

CVSS base score

9.8

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS probability

13.29%

CISA KEV

Known exploited vulnerability

CWE

CWE-1188

Published

2023-12-05

Last modified

2025-10-21

Affected products

• Unitronics VisiLogic

Weakness type

• CWE-1188

Related vulnerabilities

• CVE-2023-27524 — Apache Superset: Session validation vulnerability when using provided default SECRET_KEY
• CVE-2022-24706 — Remote Code Execution Vulnerability in Packaging
• CVE-2021-41192 — Insecure default configuration
• CVE-2026-47668 — DbGate: Unauthenticated Remote Code Execution via JSON Script Runner
• CVE-2024-2912 — Insecure Deserialization Leading to RCE in bentoml/bentoml
• CVE-2026-52824 — Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover
• CVE-2026-31957 — Himmelblau unset domain configuration can allow any-tenant authentication at first login for remote deployments
• CVE-2026-28775 — Unauthenticated RCE via SNMP Default Writable Community String

Markdown version · Browse all CVEs