CISA warns of rising attacks on internet-exposed water sector PLCs

Changing a PLC's password is a supported configuration operation. So is changing its IP address. CISA's advisory records both being done to water-sector controllers by outsiders: passwords modified to lock operators out of their own equipment, and IP addresses changed to disconnect the controller ^[3]. Neither action requires a software defect. The advisory identifies no vulnerability with a CVE number ^[2].

That makes the remediation list an inventory exercise. Three of the four recommended steps operate on a specific named device: disconnecting a controller from the internet, allowlisting the engineering laptops permitted to reach it, and holding a known clean image of it ^[8]. Each presupposes that the controller appears on a list somewhere. Enabling password protection has the same precondition, since somebody has to log in to do it.

The author of the dev.to writeup approached this from the other end, querying an internet-wide index by protocol instead of by address range. US-scoped queries in the same 15 September run matched 5,118 Modbus services and 4,745 assets on port 502 ^[11]. The US service count is about 10.9 percent of the 47,028 global matches ^[1]. The port-502 figure is about 92.7 percent of the US service count ^[2], and the two queries count different objects, services in one case and assets in the other, so the 373-match difference is not a clean measure of Modbus answering on some other port.

For a matched total to mean anything to a specific utility, someone has to attribute an address to an owner, and a protocol-wide query will not do that. The writeup is explicit that the counts are matched totals from ZoomEye and not a count of compromised devices: a hit records that a service answered on the public internet at the time of the query, and does not establish vulnerable firmware, patch state, or that anyone has accessed the device ^[13].

The same run shows where scanning fails as a discovery control. ZoomEye's Rockwell Automation MicroLogix fingerprint returned zero matches, which the writeup attributes to the index's fingerprint set not currently identifying those controllers under that name. On that basis it leaves the MicroLogix 1400 out of its exposure claims, even though CISA's alert names that model ^[12].

So the internet-facing view answers a narrower question than the alert asks. It can confirm that an industrial protocol service is reachable at a given address. Matching that service to the model in the advisory, and to the utility that owns it, is separate work. CISA's own account of the activity includes cellular modems installed by operators, vendors or system integrators that may never have been documented ^[6].