CVE-2023-6448: Unitronics Vision/Samba PLC & HMI Default Password Takeover (KEV, Water Sector Attacks)

CVE-2023-6448 is an insecure-default-password flaw in Unitronics Vision and Samba series PLCs and HMIs programmed with VisiLogic before version 9.9.00: the devices ship with a default administrative password, and an unauthenticated attacker with network access who hasn't had that password changed can take full administrative control — a gap that was actively exploited against internet-exposed PLCs at US water and wastewater utilities in late 2023.

CVE-2023-6448 is a use of default credentials (CWE-1188/CWE-798) affecting Unitronics Vision and Samba series programmable logic controllers (PLCs) and human-machine interfaces (HMIs). Per NVD: "Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system" (NVD).

NVD's own analysis and the CNA submission agree: CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, full impact to confidentiality, integrity and availability (NVD).

Unitronics' own Cybersecurity Advisory 2023-001 (published 2023-12-19) names the affected component as VisiLogic (the engineering software used to program the PLCs), lists the affected product version as "VisiLogic < 9.9.00, OS < 12.38," and states the patched version "forces: changing the default administrative password; setting a password on PCOM-enabled sockets; controlling remote allowed PCOM operations using SDW10 roles." Its recommended mitigations are to disconnect the PLC from unauthorized internet access, update to VisiLogic 9.9.00/OS 12.38 or later, and — if remote access is required — put a firewall/VPN in front of the PLC and use an IP allowlist (Unitronics Cybersecurity Advisory 2023-001).

CISA added CVE-2023-6448 to the Known Exploited Vulnerabilities (KEV) catalog on 2023-12-11, due date 2023-12-18, with known ransomware-campaign use listed as "Unknown" (catalog version 2026.10.29, 1764 entries, confirmed live this run) (CISA KEV). The vulnerability gained wide attention because CISA's own alert documented real exploitation against the sector: cyber threat actors actively exploited internet-exposed Unitronics Vision Series PLCs at US water facilities, including one municipality that detected the intrusion, immediately took the affected system offline, and switched to manual operations with no impact on drinking-water safety. A related joint advisory referenced in CISA's alert ties this activity to IRGC-affiliated cyber actors. CISA's recommended mitigations include changing the default password (explicitly noting the commonly-shipped default of "1111"), enforcing multi-factor authentication for remote access, disconnecting PLCs from the public internet or placing them behind a firewall/VPN, using non-default TCP ports instead of the standard 20256, maintaining configuration backups, and keeping firmware current (CISA Alert — Exploitation of Unitronics PLCs in Water and Wastewater Systems).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.02089 (81.557th percentile) — modest in absolute terms, but still well above the median EPSS score three years after disclosure, consistent with a niche OT product that remains targeted whenever it is left exposed with its default password unchanged (FIRST EPSS).

Any Unitronics Vision or Samba PLC/HMI still running VisiLogic before 9.9.00 / OS before 12.38, or one that has never had its administrative password changed from the default, should be updated and reconfigured immediately, taken off direct internet exposure, and placed behind a firewall/VPN with IP allowlisting for any required remote access.

• Unitronics VisiLogic before 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password that lets an unauthenticated attacker with network access take administrative control. — NVD
• CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, agreed by both NVD and the CNA submission. — NVD
• Affected: VisiLogic before 9.9.00 / PLC OS before 12.38. Patched version forces a non-default admin password, a password on PCOM-enabled sockets, and SDW10-role-controlled remote PCOM operations; vendor also recommends firewall/VPN and IP allowlisting for remote access. — Unitronics Cybersecurity Advisory 2023-001
• Added to the CISA KEV catalog on 2023-12-11, due date 2023-12-18. CISA documented active exploitation of internet-exposed Unitronics PLCs at US water facilities, tied to IRGC-affiliated actors in a related joint advisory; recommended mitigations include changing the default "1111" password, MFA, and network isolation. — CISA Alert — Exploitation of Unitronics PLCs in Water and Wastewater Systems
• EPSS score is 0.02089 (81.557th percentile) as of 2026-10-29. — FIRST EPSS