The Connections You Cannot Scan: Cellular Modems and Undocumented OT Paths in the Water Sector

One sentence in CISA's 30 July 2026 alert deserves more attention than the rest of the mitigation list. After advising critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and other operational technology from the internet, the agency notes that even water organizations with mature cybersecurity processes should validate their external connections, "as this targeting activity includes cellular modems installed by operators, vendors, or system integrators that may not be documented or included in routine attack surface scans."
That sentence describes a category of exposure that conventional asset management is structurally unable to see. It is also a category that a protocol-level external observation can sometimes surface, which makes it a useful place to examine how scanning and documentation complement each other.

Why cellular paths escape the inventory

A cellular modem installed to provide remote engineering access to a remote pumping station is a legitimate solution to a real problem. It avoids a site visit, it works where wired connectivity is unavailable, and it can be installed quickly by a vendor or integrator during commissioning.
The same properties make it hard to govern. The installation may be recorded in a vendor's records rather than the operator's. The modem may present a public address that is not part of the organization's registered ranges, so an internal scan of "our" address space will not include it. It may be powered from the same cabinet as the controller and share its connectivity, so disconnecting the controller from a wired network does not remove the path. And because it was installed to solve an operational problem, removing it has consequences that require a decision rather than a rule.
The result is a device that is reachable, operationally significant, and absent from the documents that a remediation programme would use to find it.

What the alert says the risk is

CISA's description of the activity is specific. Threat actors targeted exposed PLCs, modified passwords to lock out operators, and disconnected the PLCs by changing their IP addresses. The activity resulted in boil water notices and sustained manual operations, and it affected water entities of all sizes.
The alert also names the affected controller family, pointing owners of Rockwell Automation MicroLogix 1400 PLCs to the vendor's notice on restoring access when the password is unknown. MicroLogix 1400 controllers communicate over EtherNet/IP, which provides a protocol-level handle for external observation.

Where external observation helps, and where it stops

An external protocol query can reveal reachable EtherNet/IP assets regardless of how they are connected, because it observes the network rather than the wiring diagram. On 17 September 2026, the query

port="44818" && service="ethernet-ip"

returned 41,601 assets globally. A service-only query returned 41,609, and a bare port query returned 41,965. Restricting the query to one country returned 19,977.
Those numbers describe the protocol surface, not the water sector, and they do not identify which assets sit behind cellular links. What they can do is provide a cross-check against documentation. If an organization restricts the protocol query to its known public ranges and finds nothing, that is not proof that no controller is reachable. A cellular modem on a different address would not appear. The check that matters is the reverse one: an asset that responds to a protocol query but cannot be matched to a documented connection is a candidate for exactly the undocumented path CISA described.
Vendor-level fingerprinting does not close this gap. Queries for app="MicroLogix 1400", app="Rockwell Automation MicroLogix 1400", and module_id="1766-L32BWA" each returned zero results on 17 September 2026. EtherNet/IP is a lean protocol, and a device that answers a list-identity request may not present enough banner content for a product fingerprint. Reachability, not model identification, is the observable property.

A practical approach to undocumented paths

The alert's guidance and the nature of cellular exposure suggest a sequence that treats discovery as a first-class task rather than an assumption.

• Treat the modem as an asset. Cellular links installed by vendors or integrators should be entered into the asset register with an owner, a purpose, and a review date, exactly like a server.
• Reconcile external observations against the register. Run the protocol query over all ranges the organization can legitimately claim, including vendor and integrator ranges, and investigate every match that has no corresponding record.
• Apply the same controls to every path. CISA's recommendations apply regardless of transport: remote access through a VPN or gateway rather than directly to the PLC, password protection with default passwords changed, and IP allowlisting limited to known engineering laptops or critical OT assets.
• Keep a clean image backup. CISA advises operators to maintain a known clean backup of the PLC image in case a modified password locks them out. For a device reachable through an undocumented path, that backup is the difference between a recovery and a site visit.
• Decide deliberately about removal. A cellular link may be the only practical access method for a remote site. The decision to keep it should be explicit, documented, and paired with compensating controls rather than left implicit. ## Limitations The exposure counts in this article are point-in-time observations from 17 September 2026 and reflect protocol reachability as observed by ZoomEye, subject to probe coverage and index drift. They do not identify cellular-connected assets, water utilities, or compromised devices. The relationship between cellular modems and the reported targeting is drawn from CISA's alert text; the alert does not state how many such devices were involved or which organizations were affected. No specific incident, victim, or device is identified here. ## References
• CISA, "CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs," 30 July 2026. https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs
• ZoomEye queries executed 17 September 2026, counts as recorded above.