Listen to this Post
Introduction: A Growing Warning for America’s Digital Water Backbone
Water systems are among the most essential services in modern society, yet many of the industrial machines controlling these facilities remain dangerously exposed to the public internet. A new investigation has revealed that thousands of industrial controllers used in water and wastewater operations across the United States can still be discovered online, raising fresh concerns about the cybersecurity of critical infrastructure.
The discovery comes despite years of warnings from cybersecurity researchers, equipment manufacturers, and U.S. government agencies urging organizations to isolate industrial control systems from the internet. The problem highlights a recurring weakness in operational technology (OT) environments: aging equipment, poor network segmentation, and outdated security practices continue to create opportunities for attackers.
Researchers from Forescout’s Vedere Labs found more than 4,000 exposed Rockwell Automation and Allen-Bradley industrial controllers through internet scans. Among them were dozens of devices located in cities already connected to recent cyber incidents involving U.S. water utilities.
Although exposure does not automatically mean compromise, cybersecurity experts warn that publicly accessible industrial controllers can provide attackers with valuable information about critical systems and, in some cases, the ability to modify operational settings.
Internet-Exposed Industrial Controllers Create New Risks for Water Infrastructure
The research revealed that more than 4,000 Rockwell Automation and Allen-Bradley controllers were accessible from the internet. These devices are commonly used in industrial environments to control pumps, valves, pressure systems, chemical processes, and other operational functions.
A significant portion of the exposed systems were located in the United States. According to the research, approximately 2,844 devices, representing around 65% of the discovered controllers, were hosted on U.S. networks.
Many of these devices communicate through EtherNet/IP, an industrial networking protocol widely used in manufacturing, utilities, and automation environments. While the protocol itself is designed for reliable industrial communication, exposing it directly to the internet introduces significant security risks.
Attackers who locate these devices may be able to gather information about the equipment, identify vulnerabilities, or attempt unauthorized changes depending on the configuration and security controls in place.
Federal Warnings Follow Cyberattacks Against Water Utilities
The discovery comes shortly after a joint warning from the Federal Bureau of Investigation (FBI) and the Environmental Protection Agency (EPA) regarding cyberattacks targeting water and wastewater organizations.
Officials confirmed attacks affecting utilities in multiple U.S. states, including Michigan, South Dakota, and Georgia. In one incident, attackers reportedly accessed programmable logic controllers (PLCs) and modified system settings, including network configurations and passwords.
These changes disrupted operators’ ability to monitor and manage their own equipment. Some attacks reportedly caused operational problems, including pressure loss and flooding incidents.
While some reports suggested possible involvement by Iranian-linked threat actors, researchers from Forescout emphasized that they have not officially attributed the activity to any specific group.
Instead, researchers believe the incidents resemble broad internet scanning campaigns searching for vulnerable industrial systems rather than highly targeted attacks using unknown vulnerabilities.
Attackers Increasingly Target Programmable Logic Controllers
Programmable Logic Controllers (PLCs) are the digital brains behind many industrial operations. In water facilities, PLCs help regulate processes such as water distribution, pumping stations, filtration, and chemical treatment.
The recent investigations focused heavily on Rockwell Automation’s Allen-Bradley PLC families, especially:
MicroLogix 1100 controllers
MicroLogix 1400 controllers
CompactLogix 1769 controllers
ControlLogix 5590 devices
Forescout’s analysis showed that MicroLogix 1400 controllers represented roughly half of all exposed devices discovered during the scan.
CompactLogix 1769 systems accounted for approximately 22%, while MicroLogix 1100 and ControlLogix 5590 devices each represented around 8%.
The widespread presence of these systems demonstrates how older industrial technology continues to operate in environments where cybersecurity requirements have dramatically changed.
22 Devices Found in Cities Previously Affected by Cyberattacks
Researchers compared their findings against municipalities connected to recent water-sector cyber incidents.
They identified 22 internet-exposed controllers located in cities affected by previous attacks. However, researchers stressed that they could not confirm these systems were compromised or belonged directly to attacked utilities.
The discovery serves as a warning sign rather than proof of active intrusion.
Security experts often describe internet exposure as the first stage of an attack chain. Criminal groups and state-backed hackers frequently scan the internet looking for vulnerable devices before attempting exploitation.
An exposed controller does not guarantee an attacker can immediately manipulate physical systems, but it significantly lowers the barrier for reconnaissance.
Old Vulnerabilities Continue to Threaten Modern Infrastructure
One of the biggest concerns identified by researchers was the presence of devices potentially affected by older vulnerabilities.
Among the exposed systems, 19 of the 22 controllers found in affected cities appeared to potentially contain exposure to CVE-2017-16740, a remote code execution vulnerability affecting certain MicroLogix 1400 devices.
The vulnerability was disclosed years ago, proving that industrial cybersecurity challenges are often not caused by unknown threats but by known weaknesses that remain unresolved.
However, researchers noted that exploitation requires specific conditions, including Modbus TCP being enabled. They were unable to confirm whether those settings were active on the identified devices.
This situation reflects a common challenge in operational technology security: many organizations operate equipment for decades, making patching and modernization difficult.
Manufacturers Have Warned About Internet Exposure for Years
Rockwell Automation and other industrial technology manufacturers have repeatedly advised customers not to connect PLCs directly to the public internet.
Since at least 2018, security guidance has recommended using protective measures such as:
Network segmentation
Industrial firewalls
VPN-based remote access
Multi-factor authentication
Continuous monitoring
Asset inventory management
Despite these recommendations, thousands of systems remain visible online.
The persistence of this issue suggests that cybersecurity improvements in critical infrastructure are moving slower than the threat landscape.
Additional Weaknesses Found Beyond Industrial Controllers
The research also uncovered broader security problems affecting digital infrastructure connected to water organizations.
Researchers identified:
Expired digital certificates
Abandoned remote-access portals
Forgotten web services
Outdated servers
Unmaintained internet-facing systems
In one example, researchers found a server displaying only a default Microsoft webpage since 2019, suggesting that the system may have been abandoned but remained publicly reachable.
These forgotten assets create additional entry points for attackers.
Cybersecurity teams often focus on protecting active systems but overlook outdated infrastructure that attackers can exploit as a pathway into larger networks.
Deep Analysis: Understanding the Industrial Cybersecurity Threat
Industrial systems require a different security approach compared with traditional IT environments.
A corporate laptop can usually be patched quickly after discovering a vulnerability. Industrial controllers, however, often operate continuously for years because shutting them down can interrupt essential services.
Water utilities face a difficult balance:
Maintaining uninterrupted operations.
Protecting aging technology.
Managing limited cybersecurity budgets.
Supporting legacy equipment.
Training specialized staff.
Attackers understand these challenges.
A PLC running outdated firmware may not look valuable to traditional cybercriminals, but in critical infrastructure environments, even small changes can create real-world consequences.
Example commands security teams may use for asset discovery:
nmap -sV -p 44818 <target-range>
EtherNet/IP commonly uses TCP port 44818, making exposed devices easier for attackers to identify.
Security teams can also monitor industrial protocols:
tcpdump -i eth0 port 44818
Network segmentation testing:
traceroute <industrial-device-ip>
Asset discovery and vulnerability management should include:
nmap -Pn -sV --script vuln <device-ip>
However, scanning industrial environments must be performed carefully because aggressive testing can disrupt sensitive equipment.
The bigger lesson is that cybersecurity cannot only focus on malware detection. Protecting modern infrastructure requires understanding physical systems, industrial protocols, and operational risks.
What Undercode Say:
The exposure of thousands of industrial controllers is another reminder that cybersecurity is no longer only a digital problem.
Critical infrastructure attacks can move from computer screens into the physical world.
Water systems represent one of the most attractive targets for attackers because they directly impact communities.
A successful attack does not necessarily require sophisticated malware.
Sometimes, the greatest weakness is simply a device connected to the internet without proper protection.
The discovery of more than 4,000 exposed controllers shows that basic security practices remain incomplete across many organizations.
Internet-facing industrial equipment should be considered a high-risk asset.
A PLC controlling water pressure or chemical treatment should never be treated like a normal office computer.
The technology may be old, but the consequences of compromise are very modern.
Attackers increasingly rely on automated scanning tools to discover vulnerable systems.
This means organizations cannot depend on attackers failing to find exposed devices.
If a device is online, eventually someone will discover it.
The most concerning aspect is not only the number of exposed controllers but the age of many vulnerabilities affecting them.
CVE-2017-16740 is an example of a security issue that has existed for years but continues to appear in real-world environments.
This demonstrates a major challenge in industrial cybersecurity: vulnerability disclosure does not equal vulnerability removal.
Many utilities lack the resources, personnel, or operational flexibility needed to rapidly modernize their environments.
Government agencies continue releasing warnings, but warnings alone cannot secure infrastructure.
Organizations need funding, technical support, and mandatory cybersecurity standards.
The future of critical infrastructure security will depend on visibility.
Utilities cannot protect devices they do not know exist.
Comprehensive asset inventories should become a fundamental requirement.
Remote access systems also require stronger controls.
Legacy VPNs, forgotten portals, and outdated certificates often become hidden attack paths.
Cybersecurity teams must move from reactive defense toward continuous monitoring.
The industrial world needs the same security mindset that exists in modern cloud environments.
Zero trust principles should expand beyond corporate networks into industrial environments.
Every connection should be verified.
Every device should be monitored.
Every access attempt should be controlled.
The water sector is only one example.
Similar risks exist in energy, transportation, manufacturing, and healthcare infrastructure.
As society becomes more dependent on connected systems, cyber resilience becomes a national security priority.
The next major infrastructure incident may not come from an advanced zero-day exploit.
It may come from a forgotten device that has been exposed for years.
✅ Confirmed: Thousands of industrial controllers were discovered exposed online.
Forescout’s Vedere Labs research identified more than 4,000 internet-accessible Rockwell Automation and Allen-Bradley controllers through public internet scanning.
✅ Confirmed: Water utilities have faced cyber incidents involving industrial systems.
U.S. authorities confirmed attacks affecting multiple water and wastewater organizations and warned about risks involving PLC devices.
❌ Not confirmed: All exposed controllers were compromised.
Exposure only indicates that devices were reachable online. Researchers did not confirm that every identified system had been attacked.
✅ Confirmed: Older vulnerabilities remain a concern.
Researchers identified possible exposure to CVE-2017-16740 affecting certain MicroLogix devices, demonstrating continued risks from outdated industrial equipment.
Prediction
(+1) Critical infrastructure cybersecurity investment will accelerate as governments and utilities recognize the growing risks.
Future regulations will likely push water organizations toward stronger network segmentation, better monitoring, and stricter controls for internet-connected industrial devices.
(+1) Industrial cybersecurity platforms will become a major growth market.
Organizations will increasingly adopt specialized solutions designed for operational technology environments rather than relying only on traditional IT security tools.
(-1) Legacy industrial equipment will continue creating security problems for years.
Many utilities cannot immediately replace decades-old systems, meaning vulnerable controllers and outdated technologies will remain attractive targets.
(-1) Attackers will continue using automated scanning to discover exposed infrastructure.
The low cost of internet-wide scanning means cybercriminals and threat groups will keep searching for poorly protected industrial devices.
The future of water security will depend not only on protecting pipes and treatment facilities but also on protecting the invisible digital systems controlling them.
▶️ Related Video (78% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberscoop.com
Extra Source Hub (Possible Sources for article):
https://www.github.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
