How severe is CVE-2023-2003?

CVE-2023-2003 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability high.

Is CVE-2023-2003 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (56th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-2003?

CVE-2023-2003 affects Unitronics Vision1210 Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2023-2003?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2023-2003 published?

CVE-2023-2003 was published on 2023-07-13 and last updated on 2026-06-17.

CVE-2023-2003

CVE-2023-2003 is a critical-severity vulnerability in Unitronics Vision1210 Firmware with a CVSS 3.x base score of 9.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-506.

Key facts

Severity: Critical (CVSS 3.x base score 9.1)
EPSS exploit prediction: 1% (56th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-506
Affected product: Unitronics Vision1210 Firmware
Published: 2023-07-13
Last modified: 2026-06-17

Description

Embedded malicious code vulnerability in Vision1210, in the build 5 of operating system version 4.3, which could allow a remote attacker to store base64-encoded malicious code in the device's data tables via the PCOM protocol, which can then be retrieved by a client and executed on the device.

Frequently asked questions

What is CVE-2023-2003?: Embedded malicious code vulnerability in Vision1210, in the build 5 of operating system version 4.3, which could allow a remote attacker to store base64-encoded malicious code in the device's data tables via the PCOM protocol, which can then be retrieved by a client and executed on the device.
How severe is CVE-2023-2003?: CVE-2023-2003 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability high.
Is CVE-2023-2003 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (56th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-2003?: CVE-2023-2003 affects Unitronics Vision1210 Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2023-2003?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2023-2003 published?: CVE-2023-2003 was published on 2023-07-13 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:o:unitronics:vision1210_firmware:4.3:build_5:*:*:*:*:*:*

More vulnerabilities in Unitronics Vision1210 Firmware

CVE-2023-6448 — Critical (CVSS 9.8): Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative…

All CVEs affecting Unitronics Vision1210 Firmware →

Other CWE-506 vulnerabilities

CVE-2026-28353 — Critical (CVSS 10.0): Trivy Vulnerability Scanner is a VS Code extension that helps find vulnerabilities. In Trivy VSCode Extension version…
CVE-2024-3094 — Critical (CVSS 10.0): Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of…
CVE-2026-48027 — Critical (CVSS 9.8): Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was…
CVE-2026-8398 — Critical (CVSS 9.8): A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421…
CVE-2026-44484 — Critical (CVSS 9.8): PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have…
CVE-2026-6443 — Critical (CVSS 9.8): All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to…

Browse all CWE-506 vulnerabilities →