More than 4,100 PLC exposed to the Internet The real risk for water and purification plants

Recent incidents affecting water and purification plants in the United States have highlighted a worrying reality:. Public scans by security companies show over 4,100 EtherNet / IP devices exposed globally and thousands in the US. The United States, while specific investigations found controllers in cities that suffered operational interruptions. That so many units are connected without filters or isolation is not a theoretical failure: it is a configuration that facilitates access and remote handling.

A critical point to understand is that a zero-day vulnerability is not always needed to cause damage. According to sectoral analysis, attackers in some cases managed to change IP addresses and put passwords on already achievable PLC, resulting in operators losing visibility or control of connected equipment. The EtherNet / IP exposure in port 44818 can offer an unauthenticated path to identify and, depending on the configuration, rewrite control parameters, which makes a bad access architecture an effective vector without the need for complex exploitation chains.

In addition to Internet exposure, there is another variable that increases the risk: the large proportion of PLC detected on mobile operator networks. The analysis shows that large operators concentrate much of these endpoints, suggesting that poorly configured or shared cell modems between multiple customers can serve as a replicable input point. Public notices from agencies such as the FBI and EPA have called for strengthening the authentication of modems and isolating remote access through private APN, VPN or equivalent architectures.

In specific technical terms, some of the exposed drivers ran firmware vulnerable to CVE-2017-16740, an overflow on Modbus TCP that Rockwell corrected years ago. Updating firmware is still necessary, but not enough: updates repair specific failures; PLC public exposure is unacceptable even if the firmware is patched. For incident recovery, Rockwell published guides to restore MicroLogix 1100 / 1400 to factory values and reapply known projects, but that track requires unconnected copies of the driver's logic, an operational requirement that many operators do not meet.

The implications for risk management are broad. A PLC handled in a water plant can alter pumps, valves or treatment processes, with direct impact on service continuity and public safety. There is also the risk of repeated commitments when external suppliers replicate vulnerable configurations between customers. The essence of the problem is architecture and governance: inventory, segmentation and access control must be predominated on isolated patches.

The urgent actions that should be implemented by operators and critical infrastructure officials include immediately removing PLC from public access, blocking or filtering the EtherNet / IP port (44818) in exposed perimeters, and migrating remote access to private and authenticated channels. It is essential to maintain offline and versioned copies of the controller logic (project files), activate records and detection of changes in side logic, and deploy continuous monitoring and integrity exercises to detect changes in control projects. Third-party configurations should be audited and hardened to avoid "home effects" between customers sharing the same network template.

For those who manage technical safety and risk management, it is also key to coordinate with security authorities and forces and to respond with contingency plans including notification and recovery. Official resources and vulnerability databases are useful for prioritizing actions: the NVD public entry on CVE-2017-16740 for technical details and references, as well as the documentation of agencies that publish guides for industrial and control systems, can be consulted. CVE-2017-16740 in NVD and the web of good practice for CISA control systems offer starting points for training and hardening. CISA guides and notices on ICS and sectoral research of manufacturers and suppliers help translate these recommendations into operational policies. Forecout and other industrial asset visibility providers also publish analyses that can enrich inventories and detection exercises.

In short, the incident should not be read only as a timely safety failure: it is a reminder that the digitization of physical infrastructure requires the application of network security principles to systems that have historically been designed for isolated environments. Disconnect, segment, authenticate and store offline copies of the logical control are measures that reduce the risk today; building governance that prevents the same mistakes from being made again is the medium-term task.