A recent scan of internet-connected industrial equipment has revealed over 4,000 Rockwell Automation and Allen-Bradley controllers exposed online, including 22 located in cities recently affected by cyberattacks on U.S. water systems. This exposure persists despite years of warnings from manufacturers and federal agencies regarding the risks of direct internet access to such critical infrastructure.
The findings, published by Forescout's Vedere Labs, indicate that 2,844 (65%) of the exposed controllers are located within the United States. These devices utilize EtherNet/IP, an industrial protocol for communication between control equipment. When the associated port is open to the public internet, external users may be able to identify devices and potentially alter settings or write new configurations, depending on the system's setup.
The scan, conducted via the Shodan search engine, identified the MicroLogix 1400 as the most common exposed device family, accounting for half of the devices found. Other versions, such as Allen-Bradley's CompactLogix 1769 controllers, made up 22%, while MicroLogix 1100 and ControlLogix 5590 devices each represented approximately 8%. Forescout cross-referenced these machines with recently targeted cities and municipalities, identifying 22 exposed devices, though the company did not confirm if these specific systems were attacked or belonged to the affected utilities.
The FBI and Environmental Protection Agency (EPA) issued a joint advisory confirming attacks on water and wastewater utilities in at least 12 states since July 27. Michigan, South Dakota, and Georgia have been named among the affected states, with nine systems hit in Michigan and one wastewater lift station in South Dakota. The advisory stated that attackers targeted programmable logic controllers (PLCs) from Rockwell Automation's Allen-Bradley brand, specifically the MicroLogix 1100 and 1400 models.
In at least one confirmed instance, attackers remotely accessed controllers, changing their IP addresses and passwords, which severed the utility's ability to view and control the equipment. The advisory noted that these attacks resulted in pressure loss and flooding.
While several reports have linked these attacks to Iranian actors, Forescout has not attributed the activity to any specific group. Instead, the evidence suggests opportunistic, at-scale exploitation of known vulnerabilities affecting internet-exposed devices. The speed and scale of the activity are more consistent with mass scanning and enumeration rather than a months-long intrusion campaign, zero-day exploitation, or custom malware.
Forescout's research also found that 19 of the 22 hosts in affected cities appeared, based on their firmware versions, to be susceptible to CVE-2017-16740. This remote code execution flaw, disclosed in 2017, impacts MicroLogix 1400 devices. Exploiting this vulnerability would require Modbus TCP to be enabled, which researchers could not confirm for the affected systems.
Rockwell Automation and other industrial equipment manufacturers have advised customers against placing controllers directly on the public internet since as early as 2018. Beyond the controllers themselves, researchers also examined digital records tied to these utilities, uncovering expired certificates, unrenewed remote-access web addresses, and seemingly abandoned servers, including one that has displayed a default Microsoft webpage since April 2019. These stale services can expand the attack surface, though the precise method of the observed attacks has not yet been confirmed.
