CVE-2023-6448 is an insecure-default-password weakness affecting certain Unitronics industrial devices. It means the device may ship with a factory or missing password that is easy to guess or already known, letting an attacker log in, send remote commands, or change control settings without authorization.
This matters because Unitronics PLCs and HMIs often sit at the edge of operational networks and can influence real-world processes. In attacks, exposed devices are found on the internet and probed for weak credentials; if successful, an intruder may disrupt monitoring or control. Defenders reduce the risk by removing public exposure, changing default credentials, segmenting OT networks, restricting remote access, and monitoring for unexpected logins or configuration changes.