Critical 9.8Known exploited (CISA KEV)Published Dec 5, 2023

CVE-2023-6448Unitronics VisiLogic uses a default administrative password

Updated under an hour ago (Oct 26, 2026, 1:20 PM ET)

Does this affect you?

It affects Unitronics VisiLogic and 16 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Dec 11, 2023; federal agencies had to remediate by Dec 18, 2023. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Unitronics VisiLogic

Exploited in the last 30 days

Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-1188
Known exploited: Added to CISA KEV Dec 11, 2023; federal remediation due Dec 18, 2023Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
EPSS (exploitation in the next 30 days): 2.09% (percentile 81)
Assigned by: cisa-cg
NVD analysis: Analyzed
Record last updated: Oct 21, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Unitronics VisiLogic unitronics:visilogic (from the name)	before 9.9.00	CNA record
unitronics visilogic unitronics:visilogic	before 9.9.00	CISA ADP
unitronics vision1210_firmware unitronics:vision1210_firmware	before 12.38	NVD
unitronics vision1040_firmware unitronics:vision1040_firmware	before 12.38	NVD
unitronics vision700_firmware unitronics:vision700_firmware	before 12.38	NVD
unitronics vision570_firmware unitronics:vision570_firmware	before 12.38	NVD
unitronics vision560_firmware unitronics:vision560_firmware	before 12.38	NVD
unitronics vision430_firmware unitronics:vision430_firmware	before 12.38	NVD
unitronics vision350_firmware unitronics:vision350_firmware	before 12.38	NVD
unitronics vision130_firmware unitronics:vision130_firmware	before 12.38	NVD
1–10 of 19

References

References

https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems	government-resource, third-party-advisory, us-government-resource
https://www.unitronicsplc.com/cyber_security_vision-samba/	product
https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdf	release-notes
https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf	vendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-6448	us-government-resource

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.