CVE-2024-1480: Unitronics Vision Auth Bypass Vulnerability

CVE-2024-1480 Overview

CVE-2024-1480 affects the Unitronics Vision Standard line of programmable logic controllers (PLCs). The flaw allows a remote attacker to retrieve the Information Mode password without authentication. The Information Mode password protects access to controller diagnostics and runtime data. An attacker reaching the device over the network can request the credential and use it to interact with protected functions. The weakness is tracked under CWE-257: Storing Passwords in a Recoverable Format and stems from how the controller exposes sensitive authentication material on the network interface. CISA published advisory ICSA-24-109-01 covering the issue.

Critical Impact
Unauthenticated network attackers can recover the Information Mode password from Unitronics Vision Standard PLCs and gain access to protected controller functions used in operational technology environments.

Affected Products

Unitronics Vision Standard line of programmable logic controllers
Vision series PLCs exposing the Information Mode interface over the network
Industrial control system deployments using affected Unitronics firmware

Discovery Timeline

2024-04-19 - CVE-2024-1480 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1480

Vulnerability Analysis

The vulnerability resides in the network-facing protocol used by Unitronics Vision Standard PLCs to handle Information Mode interactions. The controller accepts requests for the Information Mode password and returns the credential without verifying the requester. An attacker with network reachability to the PLC can request the password directly. Information Mode provides read access to controller state, diagnostics, and configuration data used by operators and engineering workstations. Disclosure of this credential exposes sensitive operational information about the controlled process. The Common Weakness Enumeration classification CWE-257 indicates the password is stored or transmitted in a recoverable form rather than being protected by a one-way function or strong authentication exchange.

Root Cause

The root cause is the absence of an authentication check on the protocol command that returns the Information Mode password. The PLC firmware treats password retrieval as an unauthenticated information request. Combined with recoverable password storage, this design allows an attacker to obtain the credential by issuing a single network request.

Attack Vector

Exploitation requires network access to the PLC management protocol. No user interaction or prior credentials are needed. An attacker sends a crafted request to the controller and parses the password from the response. The exploitation does not require special privileges or local access to the device. Refer to the Dragos advisory on Unitronics Vision Standard for additional protocol context.

Detection Methods for CVE-2024-1480

Indicators of Compromise

Unexpected inbound connections to Unitronics PLC management ports from non-engineering hosts
PLC traffic originating from IT network segments or external addresses
Repeated Information Mode requests from a single source within a short interval
Unauthorized changes to controller configuration following network reconnaissance activity

Detection Strategies

Inspect industrial protocol traffic for Information Mode command sequences directed at Unitronics Vision controllers
Baseline normal engineering workstation behavior and alert on credential retrieval from unexpected sources
Correlate PLC access events with authorized maintenance windows in change management records
Deploy passive operational technology (OT) network monitoring at the boundary between IT and Purdue Level 2 networks

Monitoring Recommendations

Forward PLC network telemetry and firewall logs to a central analytics platform for retention and search
Monitor for scanning behavior targeting Unitronics-specific TCP ports across the OT environment
Track authentication and configuration events on engineering workstations that communicate with affected PLCs

How to Mitigate CVE-2024-1480

Immediate Actions Required

Inventory all Unitronics Vision Standard controllers and confirm firmware versions against vendor guidance
Restrict network access to PLC management interfaces using firewall rules and access control lists
Place affected controllers behind a properly segmented OT network with no direct internet exposure
Review the CISA advisory ICSA-24-109-01 for vendor-specific remediation steps

Patch Information

Unitronics has provided guidance through the CISA advisory ICSA-24-109-01. Operators should follow vendor remediation instructions and apply firmware updates where available. Where firmware updates are not yet available for a deployed controller, compensating controls at the network layer are required.

Workarounds

Block external access to PLC ports at perimeter firewalls and restrict to engineering workstations only
Require remote access to the OT network through a hardened VPN with multi-factor authentication
Disable or restrict the Information Mode interface where operationally feasible
Implement network segmentation aligned with the Purdue Enterprise Reference Architecture to isolate PLCs from corporate networks

bash

# Example firewall restriction limiting PLC access to a dedicated engineering subnet
# Replace 10.20.30.0/24 with the engineering workstation subnet
# Replace 10.40.50.10 with the Unitronics PLC address
iptables -A FORWARD -s 10.20.30.0/24 -d 10.40.50.10 -p tcp --dport 20256 -j ACCEPT
iptables -A FORWARD -d 10.40.50.10 -p tcp --dport 20256 -j DROP