Attacker Value
Very High
(1 user assessed)
Exploitability
Very High
(1 user assessed)
User Interaction
None
Privileges Required
None
Attack Vector
Network
2

CVE-2023-6448

Disclosure Date: December 05, 2023 •
CVE-2023-6448 CVSS v3 Base Score: 9.8
Exploited in the Wild
Reported by inokii and 2 more...
View Source Details
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.

Add Assessment

1
Ratings
  • Attacker Value
    Very High
  • Exploitability
    Very High
CISA KEV ListedCommon in enterpriseEasy to weaponizeGives privileged accessObserved in state-sponsored attacksUnauthenticatedVulnerable in default configuration
Technical Analysis

The Cybersecurity and Infrastructure Security Agency (CISA) is actively addressing a situation involving the unauthorized use of Unitronics programmable logic controllers (PLCs), specifically in the Water and Wastewater Systems (WWS) Sector. These PLCs, vital for water treatment processes, have been compromised by cyber attackers, particularly targeting a specific Unitronics PLC at a water facility in the United States. In reaction, the local water authority responsible for the facility promptly disconnected the compromised system from their network and reverted to manual operations. Fortunately, there is no immediate threat to the community’s drinking water or overall water supply.

Unauthorized access and efforts to breach the security of WWS systems pose a significant risk. Such actions can disrupt the provision of clean drinking water and the efficient treatment of wastewater in affected communities.

The cybercriminals in this instance seemingly gained access to the targeted device, a Unitronics Vision Series PLC equipped with a Human Machine Interface (HMI), by exploiting cybersecurity vulnerabilities. These vulnerabilities include inadequate password security measures and the PLC’s exposure to the internet.

By default the Unitronics PLC default password = “1111”

Log in to Add Reply
CVSS V3 Severity and Metrics
Base Score:
9.8 Critical
Impact Score:
5.9
Exploitability Score:
3.9
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Offensive Application
Unknown
Utility Class
Unknown
Ports
Unknown
OS
Unknown
Vulnerable Versions
VisiLogic 9.9.00
Prerequisites
Unknown
Discovered By
Unknown
PoC Author
Unknown
Metasploit Module
Unknown
Reporter
Unknown

Vendors

  • unitronics

Products

  • samba 3.5 firmware,
  • samba 4.3 firmware,
  • samba 7 firmware,
  • visilogic,
  • vision1040 firmware,
  • vision120 firmware,
  • vision1210 firmware,
  • vision130 firmware,
  • vision230 firmware,
  • vision280 firmware,
  • vision290 firmware,
  • vision350 firmware,
  • vision430 firmware,
  • vision530 firmware,
  • vision560 firmware,
  • vision570 firmware,
  • vision700 firmware

Exploited in the Wild

Reported by:
Technical Analysis