Recent research has highlighted a worrying exposure problem in industrial environments: exposed Rockwell PLCs were detected online at scale, including in cities tied to recent cyberattacks against US water utilities. While the scan results focus on reachable devices rather than proven compromises, the pattern underscores how quickly operational impact can follow when industrial controllers are accessible from the public internet.
Forescout reported that its August 3 scan counted 4,407 exposed Rockwell controllers worldwide. The same dataset included 2,844 exposed controllers in the United States. Importantly, the researchers could not confirm that any of these controllers were actually compromised.
What the scan actually measured
It’s easy to misread numbers like these. Forescout’s count refers to exposed controllers—devices that were reachable from the internet—not to the number of affected water utilities or to the number of confirmed victims.
Even so, exposure matters. A reachable PLC can become a stepping stone, a source of information, or a target for changes that disrupt normal operations. In other words: defenders should treat “reachable” as an immediate risk signal, even when compromise isn’t confirmed.
Water-attack cities: 22 internet-facing PLCs found
In a related finding, Forescout identified 22 internet-facing Rockwell Automation PLCs located in cities hit by cyberattacks involving US water utilities. Of those, 19 used the same mobile carrier network.
The key point is not just the number, but the operational context. Water and wastewater systems are mission-critical infrastructure, and remote access paths can be especially attractive to attackers—particularly when the same networking approach is reused across multiple sites.
Forescout noted that its scan could not verify whether these specific controllers had been compromised. However, it described publicly described effects that could be achieved through actions other than exploiting a software vulnerability.
How attackers may cause impact without a confirmed exploit
According to Forescout, the kinds of outcomes described publicly could be possible without using a vulnerability exploit. Instead, attackers may have modified controller communications so that operators lose visibility and, in some situations, control of connected equipment.
In the scenario described, attackers changed IP addresses and set passwords on PLCs that were already reachable. If the legitimate network path and credentials no longer match what the operator expects, it can look like a system outage—or worse, like the process is running under unexpected parameters—until the engineering team can restore access.
At the same time, neither public government alerts nor Forescout’s analysis explains how attackers found, selected, or initially accessed the targets in the first place. That missing “entry path” detail is important for defenders, because it limits how well teams can measure exposure against their own detection coverage.
Why internet exposure is the core problem
One of the clearest risk drivers in the research is the handling of industrial protocols. Forescout explained that exposing EtherNet/IP on port 44818 creates an unauthenticated access path that—depending on the controller configuration—can allow an attacker to identify a controller or even write settings.
This is the kind of exposure that can scale easily: once a device is reachable and services are available, automated scanning can locate it, fingerprint it, and attempt configuration changes. Even if a given device is hardened against direct exploitation, misconfiguration and weak access control can still create an attack surface.
Large mobile networks account for most US exposure
In the US portion of the exposed set, Forescout reported that more than 70% of exposed controllers were on large mobile carrier networks.
That matters for network design. Mobile connectivity often involves remote access patterns that are difficult to monitor at the same granularity as private network segments. It can also encourage teams to keep PLCs reachable for convenience—even though that convenience can be costly during an incident.
The FBI and EPA recommended stronger authentication, keeping modem firmware up to date, and improving logging for cellular modems. They also advised isolating remote access through architectures such as a private APN, a VPN, or an equivalent design that prevents direct exposure to the public internet.
How many devices were seen: Censys snapshot vs. Forescout
Another perspective came from a Censys snapshot captured on July 30. That snapshot identified 4,148 Rockwell/Allen-Bradley EtherNet/IP hosts, with Verizon Business, AT&T Mobility, and T-Mobile USA representing 59% of that share.
Both Censys and Forescout exceeded 4,100 hosts, which signals the issue is widespread. However, the figures are not directly comparable: different platforms, queries, and dates can produce different visibility into what is actually reachable.
Forescout also published a historical series. It reported a June 2026 low of 4,169 exposed controllers, down 47% from 7,814 in March 2020. In that context, the August 3 snapshot of 4,407 suggests the exposure level fluctuates rather than steadily improving.
Device models and the firmware vulnerability mentioned
Forescout’s results included model-specific concentration. MicroLogix 1400 devices represented 50% of the exposed controllers, while MicroLogix 1100 devices made up 8%.
The FBI and EPA explicitly named both device families. Forescout further stated that 19 of the 22 controllers found in the affected cities ran firmware susceptible to CVE-2017-16740 (Rockwell CVSS score: 8.6).
The CVE and what it enables
The vulnerability described is a Modbus TCP buffer overflow affecting MicroLogix 1400 Series B and C running firmware 21.002 and earlier. Rockwell fixed it in revision 21.003.
However, exploitation depends on Modbus TCP being enabled. Forescout said it could not verify that Modbus TCP was enabled on the hosts it found in the affected cities. That detail reinforces the larger theme: compromise impact may not require a working exploit if attackers can instead change addressing and credentials on already-reachable devices.
Even when firmware updates address specific bugs, the researchers emphasized that updates alone do not make direct public exposure acceptable.
Password recovery guidance and the discontinued model
Rockwell discontinued MicroLogix 1100 on April 30, 2022. The associated guidance referenced in the reporting includes SD1790, which addresses a scenario where an attacker-set password locks an operator out.
The guidance describes resetting the controller to factory defaults and redownloading a known-good project file. Notably, the notice carries no CVE because it is described as recovery information rather than vulnerability disclosure.
Recovery may require an offline copy of the controller logic. The FBI also indicated that at least one victim found modified PLC project files after noticing ladder logic discrepancies across multiple sites.
It further warned that similar third-party network setups could allow attackers to repeat successful compromises across different customers sharing vulnerable configurations.
What defenders can do right now
Even without confirmed compromise on every exposed device, the defensive priorities are fairly clear. The first step is to reduce exposure by removing controllers from the public internet.
From there, organizations should review remote access architectures and align them with the recommendations from the authorities: use strong authentication, ensure updates are current, enable meaningful logging, and isolate remote access through private connectivity methods such as a private APN or VPN-style designs.
Finally, teams should treat PLC recovery plans as part of incident readiness—not an afterthought. When attackers can alter IP settings or credentials, operational continuity depends on how quickly operators can regain access and restore trusted logic.
Conclusion
The discovery of exposed Rockwell PLCs numbering in the thousands shows how industrial systems can unintentionally become reachable targets. In water-attack-linked cities, researchers found internet-facing controllers and described pathways to disruption that may rely on changing IP addresses and passwords rather than a confirmed exploit.
Whatever the exact entry technique used by attackers, the practical takeaway for defenders is consistent: keep PLCs out of the public internet, harden remote access, and ensure teams can detect changes and recover quickly when control systems are targeted.
Source: https://thehackernews.com/2026/08/over-4400-rockwell-plcs-exposed-online.html
