What is the CVSS score of CVE-2023-6448?

CVE-2023-6448 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 2.1%.

Is CVE-2023-6448 being actively exploited?

Yes, CVE-2023-6448 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. Immediate patching is required.

Vision1210 Firmware CVE-2023-6448

CRITICAL

Initialization of a Resource with an Insecure Default (CWE-1188)

2023-12-05 9119a7d8-5eab-497f-8521-727c672e3725

Information Disclosure Vision1210 Firmware Vision1040 Firmware Vision700 Firmware Vision570 Firmware Vision560 Firmware Vision430 Firmware Vision350 Firmware Vision130 Firmware Vision230 Firmware Vision280 Firmware Vision290 Firmware Vision530 Firmware Vision120 Firmware Visilogic Samba 3 5 Firmware Samba 4 3 Firmware Samba 7 Firmware

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Jul 14, 2026 - 04:22 CISA

CVE Published

Dec 05, 2023 - 18:15 nvd

CRITICAL 9.8

DescriptionNVD

Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.

AnalysisAI

Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-1188. Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system. Affected products include: Unitronics Vision1210 Firmware, Unitronics Vision1040 Firmware, Unitronics Vision700 Firmware, Unitronics Vision570 Firmware, Unitronics Vision560 Firmware. Version information: version 9.9.00.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.