Finding the Exposed Controllers: Using ZoomEye to Locate Internet-Reachable EtherNet/IP Assets

On 30 July 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) published an alert stating that it was observing a significant increase in cyber threat actors targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems (WWS) Sector. The alert describes attackers reaching internet-exposed controllers, modifying passwords to lock out operators, and changing IP addresses to disconnect devices. According to CISA, this activity has resulted in boil water notices and sustained manual operations.
The alert does not name a single software defect. Its subject is reachability: controllers that answer on the public internet. That distinction matters for anyone who needs to turn the alert into an inventory question, because the first practical problem is not patching. It is finding out which of your own devices are reachable from outside, and whether the protocols they speak can be identified from the outside at all.

What the alert establishes, and what it does not

CISA's guidance is direct: critical infrastructure owners, operators, and integrators should remove publicly exposed PLCs and other operational technology (OT) from the internet as soon as possible. Remote access for operational purposes should go through a VPN or gateway device rather than directly to the PLC. The agency also recommends enabling password protection, changing default passwords, and allowlisting IP addresses so that remote access is limited to known engineering laptops or other critical OT assets.
Two limitations should be stated plainly. First, the alert does not provide a list of affected organizations, device counts, or a breakdown by vendor. Second, CISA notes that the targeting includes cellular modems installed by operators, vendors, or system integrators that may not be documented or included in routine attack surface scans. A device inventory built only from change-management records can therefore be incomplete by construction.

Why EtherNet/IP is a useful identification anchor

The alert specifically references Rockwell Automation MicroLogix 1400 PLCs, pointing owners and integrators to Rockwell Automation's notice on restoring access to a MicroLogix 1400 controller when the password is unknown. MicroLogix 1400 controllers communicate over EtherNet/IP, which in ZoomEye can be identified at the service layer.
A query executed on 17 September 2026 illustrates the scale:

port="44818" && service="ethernet-ip"

This returned 41,601 matching assets globally. For comparison, a bare port query for the same port returned 41,965, and a service-only query for service="ethernet-ip" returned 41,609. The three counts are close, which is expected: TCP port 44818 is the registered EtherNet/IP port, so assets that expose the service almost always expose it on that port.
| Query | Count | Query time (UTC) |
| --- | ---: | --- |
| port="44818" && service="ethernet-ip" | 41,601 | 2026-09-17 05:39 |
| port="44818" | 41,965 | 2026-09-17 05:39 |
| service="ethernet-ip" | 41,609 | 2026-09-17 05:39 |
What these numbers mean is narrow and should not be stretched. They count assets that ZoomEye observed responding with an EtherNet/IP service fingerprint. They do not show that any of those assets belongs to a water utility, that any of them has been attacked, or that any of them is running a MicroLogix 1400. EtherNet/IP is used across manufacturing, building automation, and process control, so the population is broader than the WWS Sector.
A narrower query can still be useful for scoping:

port="44818" && country="US"

This returned 19,977 assets on the same day. That figure describes EtherNet/IP exposure observed within one country, not water-sector exposure. Country filters narrow the geography; they do not identify the operator's industry.

Vendor fingerprinting is harder than it looks

It is tempting to search directly for the named controller. Attempts to do so produced no usable fingerprint:
| Query | Count | Query time (UTC) |
| --- | ---: | --- |
| app="MicroLogix 1400" | 0 | 2026-09-17 05:39 |
| module_id="1766-L32BWA" | 0 | 2026-09-17 05:39 |
| app="Rockwell Automation MicroLogix 1400" | 0 | 2026-09-17 05:39 |
A zero result here is a statement about fingerprint coverage, not about the absence of those devices on the internet. EtherNet/IP is a lean protocol, and a device that only answers a list-identity request may not present enough banner text for a product-level fingerprint to be assigned. The practical consequence is that a protocol-level query is often the more reliable starting point for this class of asset, and product-level attribution frequently has to come from the operator's own records rather than from an external scan.

Turning a global count into a local answer

A global count is not an inventory. The useful workflow is to use the protocol query as a filter over address space the organization actually controls, then reconcile the result against engineering records.

• Export the organization's public address ranges and known remote-access endpoints, including cellular modems and vendor-managed links.
• Restrict the protocol query to those ranges, and treat every match as a device that needs an owner, a purpose, and a documented remote-access path.
• Compare the matches against the asset register. Devices that appear in the scan but not in the register are the highest-value findings, because they are exactly the undocumented connections CISA warned about.
• For each confirmed match, verify whether access is direct or mediated by a VPN or gateway, and whether password protection and IP allowlisting are in place. ZoomEye's role in this workflow is identification and scoping. It answers the question "is this protocol reachable from the public internet, and where" in a way that a change-management database cannot, because it observes the network rather than the paperwork. It does not answer "is this device compromised," and no external scan can. ## Limitations The counts reported here are point-in-time observations from 17 September 2026 and will drift as devices are connected, disconnected, or re-indexed. ZoomEye coverage depends on what responds to its probes; a device behind a firewall, a cellular modem with no listening service, or an asset that rate-limits scanning may not appear. Country and service filters describe observed exposure, not ownership or sector. And a positive match on an EtherNet/IP service does not establish that the device is a MicroLogix 1400, that it is part of a water utility, or that it has been targeted. ## References
• CISA, "CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs," 30 July 2026. https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs
• ZoomEye queries executed 17 September 2026, counts as recorded above.