Insecure Default Password in Unitronics Vision PLC & HMI (CVE‑2023‑6448) Enables Remote Command Execution
What It Is – Unitronics Vision series PLCs and HMIs are shipped with a well‑known default password. If the password is not changed, an attacker can log in remotely and execute arbitrary commands on the device.
Exploitability – The default credential is publicly documented; no advanced exploit is required. The vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.
Affected Products – Unitronics Vision Series programmable logic controllers (PLCs) and human‑machine interfaces (HMIs).
Why It Matters for Trust & Control Assurance
- Access‑control hygiene – Default credentials bypass the fundamental control of “only authorized users may access critical OT assets.” Continuous verification that passwords have been changed is essential evidence for auditors.
- Supply‑chain oversight – The flaw originates from the vendor’s default configuration. Demonstrating that you have a process to validate and remediate insecure defaults strengthens your overall vendor‑risk posture.
- Audit‑ready logging – Detecting unauthorized logins requires proper logging and retention, providing a defensible trail for compliance frameworks such as NIST CSF 2.0.
Recommended Actions
- Immediately change the default password on every Unitronics Vision PLC/HMI to a strong, unique credential.
- Deploy a credential‑hygiene scan across your OT environment to identify any other devices with default or weak passwords.
- Enable and centralize logging of all PLC/HMI access attempts; integrate these logs with your SIEM for real‑time alerts.
- Document the remediation steps and retain evidence in your control‑assurance repository.
- Review Unitronics’ security advisories for any firmware updates that address this issue.
Source: CISA KEV – CVE‑2023‑6448