CVE-2023-2003

CRITICAL

Vision1210 <4.3 - Code Injection

Title source: llm

Description

Embedded malicious code vulnerability in Vision1210, in the build 5 of operating system version 4.3, which could allow a remote attacker to store base64-encoded malicious code in the device's data tables via the PCOM protocol, which can then be retrieved by a client and executed on the device.

References (2)

[Third Party Advisory] https://www.incibe.es/en/incibe-cert/notices/aviso-sci/embedded-malicious-code-vulnerability-unitronics-vision1210

[Third Party Advisory] https://www.hackplayers.com/2023/07/vulnerabilidad-vision1210-unitronics.html

Scores

CVSS v3 9.1

EPSS 0.0034

EPSS Percentile 56.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-506

Status published

Products (1)

unitronics/vision1210_firmware 4.3 build_5

Published Jul 13, 2023

Tracked Since Feb 18, 2026