As cited
Copy frozen at (site build).
ot ics
Despite federal warnings, thousands of U.S. industrial controllers used in water systems remain exposed online
Over 4,000 Rockwell Automation and Allen-Bradley industrial controllers remain exposed directly to the internet, including 22 in cities recently targeted by cyberattacks on U.S. water systems. A scan by Forescout's Vedere Labs identified these exposed devices despite years of warnings from manufacturers and federal agencies about the risks of direct internet access. The exposed equipment operates with EtherNet/IP, an industrial protocol that could allow attackers to identify devices and modify configurations, with at least one documented case where attackers changed IP addresses and passwords on utility controllers, causing pressure loss and flooding.
Why it matters: Water utility operators and critical infrastructure security teams must immediately audit and remediate internet-exposed programmable logic controllers, as active opportunistic exploitation at scale is occurring against known vulnerable equipment classes, and 19 of 22 exposed devices in recently attacked cities appear vulnerable to a 2017 code execution flaw.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
ot ics
Despite federal warnings, thousands of U.S. industrial controllers used in water systems remain exposed online
Over 4,000 Rockwell Automation and Allen-Bradley industrial controllers remain exposed directly to the internet, including 22 in cities recently targeted by cyberattacks on U.S. water systems. A scan by Forescout's Vedere Labs identified these exposed devices despite years of warnings from manufacturers and federal agencies about the risks of direct internet access. The exposed equipment operates with EtherNet/IP, an industrial protocol that could allow attackers to identify devices and modify configurations, with at least one documented case where attackers changed IP addresses and passwords on utility controllers, causing pressure loss and flooding.
Why it matters: Water utility operators and critical infrastructure security teams must immediately audit and remediate internet-exposed programmable logic controllers, as active opportunistic exploitation at scale is occurring against known vulnerable equipment classes, and 19 of 22 exposed devices in recently attacked cities appear vulnerable to a 2017 code execution flaw.
- Source published
- First seen by Cybersecurity Tracker