Build1 publisher2 min readPublished
ZoomEye counts 202,686 Modbus and S7 ports that answer whoever can route to them
Two ZoomEye dorks run on 2026-09-16 returned 40,917 assets on port 502 and 161,769 on port 102. Both protocols leave authentication out of the base specification, so the count measures who can reach the port.
The Engineer · Build desk
What happened
- Two ZoomEye queries executed on 2026-09-16 returned 40,917 assets on port 502, which carries Modbus TCP, and 161,769 assets on port 102, which carries Siemens S7 communication.
- Neither protocol includes authentication, authorization or encryption in its base specification, and a device performs a Modbus write to a coil register for any host that can reach the port.
- The author calls the port-based queries a deliberate limitation and says the counts measure reachable ports associated with industrial protocols, not confirmed industrial control systems.
- The same write-up puts real exposure wider than the two ports, since industrial devices are often reachable through web HMI interfaces on 80 or 443, vendor management ports and remote access services on the same host.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint With no credential to rotate and no session to expire in either protocol's base specification, the only variable a defender can move is which networks can route to the port.
- decision The first call is a scan of your own address space against your own inventory: hosts that answer on 502 or 102 and are absent from the asset list are what the exercise is for.
- cost The stronger control costs a firewall that parses the protocol down to function codes and register ranges; the budget substitute is an allowlist limited to the engineering hosts.
- exposure Anyone who reaches a coil or holding register can move a setpoint or a valve, and the consequence lands in physical equipment.
Send a well-formed Modbus write to a coil register on a host that answers on port 502, and the host performs the write [4]. The base specification gives the host no credential to check [3]. The write-up's line for this is "Reachability is control." [2]
The two figures come from port dorks: `port="502"` and `port="102"` [1]. A query on a port number matches whatever is listening there, and ZoomEye cannot say from outside whether that listener is a production controller, a lab unit, a simulator or a honeypot [5]. Some of the 202,686 endpoints are certainly not industrial devices, the author writes [6].
40,917 plus 161,769 is 202,686 [1]. Two separate result sets added together count a dual-protocol gateway twice, so the total equals the number of distinct hosts only if nothing out there listens on both ports [4]. Port 102 accounts for about 80 percent of the figure [3], and there are close to four assets on 102 for every one on 502 [2].
For any of this to transfer to an estate you run, the listener has to speak the protocol, the device behind it has to drive something physical [15], and the route from the internet has to be the route an attacker would actually take. A port count tests none of that. The author frames the queries as a deliberate limitation [8].
The reason a reachable controller is worth more to an attacker than the register it exposes is the network it sits on. An exposed controller or gateway is frequently dual-homed between the plant network and the corporate network, making it a bridge between the two, according to the write-up [11]. A dual-homed gateway defeats segmentation, so the boundary has to be enforced at the gateway itself and the traffic crossing it monitored [12].
Reconnaissance is cheaper still. Reading registers and device identification returns the process layout, the equipment vendor and the firmware version [16]. An attacker has enough there to pick the next target without touching anything.
Detection has one structural advantage here. Modbus and S7 traffic is highly regular in a stable process, and the author says deviations, new function codes and requests from unexpected source addresses are detectable and are worth alerting on [10].
What to watch
- A rerun of the same two dorks with a protocol banner check would show how many of the 202,686 ports actually answer as Modbus or S7.
- Honeypot labelling applied to the port-502 set would put a floor under how much of the 40,917 is bait.
- A parallel count of industrial web HMIs on ports 80 and 443 would test the claim that port scanning understates the exposure.