HMI/PLC control system hardened against network attack: passwords, remote access and IEC 62443 security levels
Cyber-hardening a PLC and its operator panel · default credentials, internet exposure, IEC 62443 security levels, zones and conduits
A PLC with an operator panel, whether a separate HMI wired to a controller or a single unit with the screen built onto the PLC, is also a networked computer that can be logged into, reprogrammed and stopped from outside. This page treats the HMI/PLC control system from that side: what default settings and network exposure have already been exploited, how the ISA/IEC 62443 series grades a system and its components, and what to write into the purchase so the supplier delivers a controller and panel that can be locked down without cutting the operator off from the process.
Cybersecurity of PLC-plus-HMI control systems and integrated PLC/HMI units: default and administrative passwords, remote access and internet exposure, firmware and programming-software versions, ISA/IEC 62443 security levels, foundational requirements, zones and conduits. PLC selection, CPUs and expansion are covered on the Programmable logic controller (PLC) page. The engineered delivery of a PLC system with I/O lists, IEC 61131-3 programs and FAT/SAT is covered on the PLC control system as an engineered delivery page; redundant hot-standby PLCs, SIL 3 / PL e safety PLCs, washdown PLC/HMI panels for beverage lines, HMI touchscreens, HMI alarm presentation, and control cabinet heat and protective-device design each have their own pages and are outside this one.
CNFX editorial research · Sources checked October 13, 2026 · 4 sources
Default password 1111 on an internet-facing PLC/HMI: the 2023 water-utility case
In November 2023 CISA reported active exploitation of a Unitronics Vision Series PLC with an HMI at a US water facility; the municipality's water authority took the system offline and switched to manual operation. CISA judged that the attackers likely got in through poor password security and exposure to the internet, and told owners to make sure the Unitronics default password "1111" is not in use and to disconnect the PLC from the open internet. [1]
The matching advisory, ICSA-23-348-15, gives the flaw a CVSS v3.1 base score of 9.8 (CVE-2023-6448): Vision Series PLCs and HMIs use default administrative passwords, so an unauthenticated attacker with network access can take administrative control. It lists VisiLogic programming software before version 9.9.00 and operating system versions before 12.38 as affected. CISA also notes that attackers were probing for the default port TCP 20256 and then using PCOM/TCP-specific scripts to query and validate the system, and advises using a different port where possible. [2][1]
Unitronics' own advisory states that the patched VisiLogic version forces a change of the default administrative password, sets a password on PCOM-enabled sockets, and controls which remote PCOM operations are allowed through SDW10 roles; it gives VisiLogic 9.9.00 and OS 12.38 as the minimum versions. [3]
Editorial calculation: a four-digit numeric password such as 1111 is one of 10,000 combinations (10⁴), and a factory default is not even a guess, because it is published. The lesson for a buyer is that the firmware and software version at delivery decide whether the device will let a default credential stand. [2]
Write into the order: no default or shared credentials at handover, the minimum firmware and programming-software versions, which ports and services are enabled, and that the PLC and HMI are not reachable from the internet.
02
Security levels 1 to 4, and the gap between target, capability and achieved
The ISA Global Cybersecurity Alliance's guide to ISA/IEC 62443 grades protection in four security levels. Level 1 protects against casual or coincidental violation; level 2 against intentional violation using simple means, low resources, generic skills and low motivation; level 3 against sophisticated means with moderate resources, IACS-specific skills and moderate motivation; level 4 against sophisticated means with extended resources, IACS-specific skills and high motivation. [4]
The guide separates three kinds of level. The target level (SL-T) is what the risk assessment under Part 3-2 sets for a zone or conduit and is recorded in the cybersecurity requirements specification; the capability level (SL-C) is what a system (Part 3-3) or a component (Part 4-2) can provide natively when properly integrated and configured; the achieved level (SL-A) is measured after the system is commissioned and running. [4]
For an HMI/PLC purchase the split is practical. A PLC and an HMI are components under Part 4-2, which the guide dates to 2019; the integrated control system answers to Part 3-3, dated 2013. A supplier's claim of SL-C for one controller does not establish the SL-A of the line it sits in. [4]
State the SL-T for the zone the PLC and HMI will sit in, and ask for each component's SL-C and the evidence behind it. Agree how SL-A will be checked after commissioning.
03
Seven foundational requirements, turned into questions about the PLC and its panel
ISA/IEC 62443 organises its technical requirements for systems (Part 3-3) and components (Part 4-2) under seven foundational requirements. The questions in the right-hand column are editorial; they show where each requirement lands on a PLC and its operator panel. [4]
The guide notes that FR 1 and FR 2 together amount to access control and were split only to keep the number of requirements manageable. [4]
Foundational requirement
Question for the PLC and HMI supplier
FR 1 – Identification and authentication control [4]
Can every default account be removed or changed, and does the PLC require a password on programming and remote sockets? [3]
Can the logic and configuration be backed up and restored quickly after an attack? [1]
04
Zones, conduits and keeping the operator's view when the firewall closes
The guide defines a zone as a grouping of assets by risk or by criteria such as criticality, function, location or required access, and a conduit as a logical grouping of communication channels that share security requirements and connect two or more zones. Part 3-2 calls for separating business from control system assets, safety-related assets, temporarily connected devices, wireless devices and devices connected through external networks. [4]
It also names the operator's ability to view and manipulate the equipment under control as an essential function, alongside the control function and the safety instrumented function; their loss is termed loss of view, loss of control and loss of protection. Part 3-3 requires that access control must not prevent essential functions from operating, that they keep running if the zone boundary firewall goes into fail-close or island mode, and that a denial of service on the control or safety network must not stop safety functions acting. [4]
Editorial note: for an HMI/PLC system this argues for keeping the HMI and the PLC it supervises in the same zone, or joined by a conduit that stays open in island mode; a design that routes the operator panel through the plant's office network would lose the view exactly when the boundary closes. CISA's mitigations for the 2023 case point the same way: if remote access is needed, place a firewall or VPN in front of the PLC, use an IP allowlist and require multifactor authentication for remote access to the OT network, which a VPN or gateway can add even when the PLC cannot. [1][2]
Ask for a zone and conduit drawing that shows where the PLC, HMI, engineering laptop and any remote-access gateway sit, and how the HMI keeps its connection to the PLC if the boundary firewall isolates the zone.
05
Security terms to put in an HMI/PLC order
Paste it into your enquiry below or into an email to a maker, then replace every bracket.
Devices: [PLC model; HMI model or integrated PLC/HMI; firmware and software versions]
Credentials: [no defaults at handover; roles for operator, maintenance, engineering]
Network: [ports and services enabled; no internet exposure; remote access path]
Security level: [SL-T of the zone; SL-C of each component with evidence]
Zones: [zone and conduit drawing; HMI-to-PLC path in island mode]
Recovery: [logic and configuration backup; restore procedure]
Explore company information and manufacturing capabilities, then discuss the scope of your project with a relevant supplier.
Share this page
Compiled and source-reviewed by the CNFX editorial team.
Each manufacturer above links to the page on that company's own website where the product is listed, with the date we checked it. How we source and review
· Page last updated 13 October 2026
Buyer questions
What went wrong in the 2023 Unitronics PLC/HMI attacks?
CISA says the device was likely reached over the internet using weak password security; owners were told to make sure the default password 1111 was not in use and to stop exposing default port TCP 20256. [1]
How serious was the default-password flaw?
CVE-2023-6448 has a CVSS v3.1 base score of 9.8; VisiLogic before 9.9.00 and OS before 12.38 are affected. [2][3]
What are IEC 62443 security levels?
Four levels, from protection against casual violation (SL 1) to protection against attackers with sophisticated means, extended resources, IACS-specific skills and high motivation (SL 4). [4]
What is the difference between SL-T, SL-C and SL-A?
Target is set by the risk assessment, capability is what a system or component can provide natively, achieved is measured once the system is running. [4]
Sources and what still needs a direct check
Sources checked 2026-10-13. Two notices from the US Cybersecurity and Infrastructure Security Agency (an alert and an ICS advisory) on the 2023 exploitation of PLC/HMI units, the maker's own advisory for the same flaw, and the ISA Global Cybersecurity Alliance's quick-start guide to the ISA/IEC 62443 series. The standards themselves govern the requirement texts.
