CVE-2023-6448

Unitronics Vision PLCs and HMIs ship with insecure default passwords enabling remote command execution.

This vulnerability allows attackers to execute remote commands on industrial control systems if default credentials are not changed, creating a critical supply-chain risk for DIB organizations relying on these devices. The default password is a known, avoidable flaw that bypasses authentication entirely, exposing OT environments to unauthorized access and potential ransomware entry points.

Shame score — Shipping industrial control hardware with known, exploitable default credentials is a severe negligence that directly compromises OT security and violates hardening standards.