CVE-2023-2003
CVE-2023-2003 is a critical-severity vulnerability in Unitronics Vision1210 Firmware with a CVSS 3.x base score of 9.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-506.
Key facts
- Severity: Critical (CVSS 3.x base score 9.1)
- EPSS exploit prediction: 1% (57th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-506
- Affected product: Unitronics Vision1210 Firmware
- Published:
- Last modified:
Description
Embedded malicious code vulnerability in Vision1210, in the build 5 of operating system version 4.3, which could allow a remote attacker to store base64-encoded malicious code in the device's data tables via the PCOM protocol, which can then be retrieved by a client and executed on the device.
Frequently asked questions
- What is CVE-2023-2003?
- Embedded malicious code vulnerability in Vision1210, in the build 5 of operating system version 4.3, which could allow a remote attacker to store base64-encoded malicious code in the device's data tables via the PCOM protocol, which can then be retrieved by a client and executed on the device.
- How severe is CVE-2023-2003?
- CVE-2023-2003 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability high.
- Is CVE-2023-2003 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (57th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2023-2003?
- CVE-2023-2003 affects Unitronics Vision1210 Firmware. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2023-2003?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- When was CVE-2023-2003 published?
- CVE-2023-2003 was published on 2023-07-13 and last updated on 2026-06-17.
References
- https://www.hackplayers.com/2023/07/vulnerabilidad-vision1210-unitronics.html
- https://www.incibe.es/en/incibe-cert/notices/aviso-sci/embedded-malicious-code-vulnerability-unitronics-vision1210
Affected products (1)
- cpe:2.3:o:unitronics:vision1210_firmware:4.3:build_5:*:*:*:*:*:*
More vulnerabilities in Unitronics Vision1210 Firmware
- CVE-2023-6448 — Critical (CVSS 9.8): Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative…
All CVEs affecting Unitronics Vision1210 Firmware →
Other CWE-506 vulnerabilities
- CVE-2026-46412 — Critical (CVSS 10.0): @beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS (Identity Server) with OpenID Connect…
- CVE-2026-28353 — Critical (CVSS 10.0): Trivy Vulnerability Scanner is a VS Code extension that helps find vulnerabilities. In Trivy VSCode Extension version…
- CVE-2024-3094 — Critical (CVSS 10.0): Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of…
- CVE-2026-77651 — Critical (CVSS 9.8): The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the…
- CVE-2026-77650 — Critical (CVSS 9.8): The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the…
- CVE-2026-77649 — Critical (CVSS 9.8): The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the…