🟠 High | Source: The Hacker News
Forescout researchers discovered over 4,400 Rockwell Automation PLCs directly exposed to the internet, including 22 located in US cities recently targeted by cyberattacks on water utilities. Nineteen of those 22 controllers shared the same mobile carrier network, suggesting a common deployment pattern. While no confirmed compromises were identified, the exposure represents a significant attack surface against critical national infrastructure.
Security Architect’s Take: If your organisation manages or secures OT/ICS environments, audit internet-facing Rockwell PLCs immediately and enforce network segmentation — PLCs should never be directly reachable from the public internet. Where remote access is operationally required, mandate VPN or zero-trust network access (ZTNA) with MFA rather than direct exposure.
Original advisory: Over 4,400 Rockwell PLCs Exposed Online, 22 Found in Water Attack Cities