ICS Advisory: Unitronics Vision Series

Summary:

A high-severity vulnerability (CVSS v3.1 score: 9.8) has been identified in Unitronics' Vision Series PLCs and HMIs, affecting VisiLogic versions prior to 9.9.00. The vulnerability, tagged as CVE-2023-6448, allows an unauthenticated attacker with network access to the device to take administrative control. The vulnerability is exploitable remotely, has low attack complexity, and public exploits are available. The US Cybersecurity and Infrastructure Security Agency (CISA) recommends updating to the latest VisiLogic version, changing default passwords, implementing multifactor authentication, and disconnecting the PLC from the open internet to mitigate the risk of exploitation.