Over 4,400 Rockwell PLCs Exposed Online, 22 Found in Water Attack Cities

Summary

Forescout discovered over 4,400 Rockwell Automation PLCs exposed online, with 22 found in US water utilities that were recently targeted by cyberattacks. While no compromise was confirmed, attackers could have manipulated these devices by changing IP addresses and setting passwords, leading to loss of visibility and control. The exposure of EtherNet/IP on port 44818 is a significant risk, and many of the affected devices are on mobile carrier networks.

Full text

Over 4,400 Rockwell PLCs Exposed Online, 22 Found in Water Attack Cities Swati KhandelwalAug 06, 2026OT Security / Vulnerability Forescout found 22 internet-facing Rockwell Automation programmable logic controllers (PLCs) in cities hit by recent cyberattacks on US water utilities. Nineteen used the same mobile carrier network. Its August 3 scan counted 4,407 exposed Rockwell controllers worldwide, including 2,844 in the United States, but Forescout could not confirm any were compromised. That figure counts exposed controllers, not water utilities or confirmed victims. Forescout said the publicly described effects could be achieved without a vulnerability exploit: attackers changed IP addresses and set passwords on controllers that were already reachable, causing operators to lose visibility and, in some cases, control of connected equipment. Neither the government alerts nor Forescout's analysis explains how the attackers found, selected, or initially accessed their targets. Water and wastewater utilities in at least seven states have reported incidents since July 27, the FBI and EPA said in a July 30 public service announcement. The Hacker News found on August 6 that Forescout's post says the announcement confirmed at least 12 states, while the FBI page says seven. No agency has attributed the campaign. Whatever the final count, defenders can act now by taking the controllers off the public internet. Exposing EtherNet/IP on port 44818 creates an unauthenticated path that, depending on device configuration, lets an attacker identify a controller or write settings to it, Forescout said. Forescout found more than 70% of the US-based exposed controllers on large mobile carrier networks. The FBI and EPA recommend strong authentication, updates and logging for cellular modems, with remote access isolated through a private APN, VPN or similar architecture. A July 30 Censys snapshot found 4,148 exposed Rockwell/Allen-Bradley EtherNet/IP hosts, with Verizon Business, AT&T Mobility and T-Mobile USA accounting for 59%. The Censys and Forescout snapshots both exceed 4,100 hosts, but different platforms, queries and dates make the figures not directly comparable. Forescout's historical series hit a June 2026 low of 4,169, down 47% from 7,814 in March 2020; its August 3 snapshot was 4,407. MicroLogix 1400 devices made up 50% of Forescout's results and MicroLogix 1100 devices 8%. The FBI and EPA named both families. Forescout said 19 of the 22 controllers in affected cities ran firmware susceptible to CVE-2017-16740 (Rockwell CVSS score: 8.6). The flaw is a Modbus TCP buffer overflow affecting MicroLogix 1400 Series B and C running firmware 21.002 and earlier; Rockwell fixed it in revision 21.003. Exploitation requires Modbus TCP to be enabled, which Forescout could not verify on those hosts. Firmware updates address specific bugs but "do not make direct public exposure of PLCs acceptable," the researchers wrote. Rockwell discontinued the MicroLogix 1100 on April 30, 2022. Advisory SD1790 tells operators locked out by an attacker-set password how to reset a MicroLogix 1400 or 1100 to factory defaults and redownload a known-good project file. The notice carries no CVE because it is recovery guidance, not a vulnerability disclosure. That recovery path requires a current offline copy of the controller logic. The FBI said at least one victim found modified PLC project files after spotting ladder logic discrepancies across several sites. It also warned that similar third-party network setups may let attackers repeat successful compromises across customers sharing vulnerable configurations. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  critical infrastructure, cyberattack, Firmware Security, Industrial Security, Internet Exposure, Mobile Network Security, network security, Operational Technology, Vulnerability, Water Security ⚡ Top Stories This Week New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable ⭐ Featured Resources [Webinar] How Militaries Can Trust the Data Behind Autonomous Missions Download the 5-Step Action Plan for AI-Speed Exploitation Get the Checklist for Gaining Control of AI Use Across Your Organization Get the 2026 CISO Benchmark Report Based on 600 Security Leaders

Indicators of Compromise

• cve — CVE-2017-16740

Entities