Exposed PLCs in the Water Sector: What CISA's Alert Reveals About Internet-Facing OT

On 30 July 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) published an alert warning that it was observing a significant increase in cyber threat actors targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems (WWS) Sector. The alert is notable less for a specific software defect than for the operational outcome it describes: attackers reaching internet-exposed industrial controllers, altering passwords to lock out operators, and changing IP addresses to disconnect devices. CISA states that this activity has resulted in boil water notices and sustained manual operations.
For defenders, the alert is a reminder that the most consequential operational-technology (OT) exposure is often not a vulnerability in the traditional sense. It is a reachable device.

What the alert actually says

CISA's guidance is direct: critical infrastructure owners, operators, and integrators should remove publicly exposed PLCs and other OT from the internet as soon as possible. The agency describes threat actors modifying passwords to lock out operators and disconnecting PLCs by changing their IP addresses. It notes that the targeting spans water entities of all sizes, and that even organizations with mature cybersecurity processes should validate their external connections.
One detail deserves emphasis. CISA warns that the targeting includes cellular modems installed by operators, vendors, or system integrators that may not be documented or included in routine attack surface scans. In other words, the exposure that matters may not appear in the inventory an organization believes it maintains.
CISA frames the risk in operational terms: OT assets exposed to the internet have an increased risk of defacement, configuration changes, operational disruptions, and, in severe cases, physical damage.

Why internet-facing PLCs are the core problem

The alert's recommended mitigations are consistent with a root cause of direct internet exposure:

• Disconnect the PLC from the internet. Remote access for operational purposes should go through a VPN or gateway device, not directly to the PLC.
• Enable password protection and change default passwords.
• Allowlist IPs so that remote access is permitted only from known engineering laptops or other critical OT assets.
• After disconnecting PLCs from the internet, ensure a known clean backup of the PLC image exists in case operators are locked out by a modified password. CISA also points owners of Rockwell Automation MicroLogix 1400 PLCs to the vendor's notice on restoring access to a controller when the password is unknown, and references guidance from the UK National Cyber Security Centre on secure connectivity principles for OT, along with an FBI advisory on malicious actors targeting internet-facing PLCs in the water and wastewater sector. ## Measuring the exposure surface with ZoomEye The value of an internet-wide asset search engine in this context is not to prove that any specific device is compromised. It is to quantify how much of a given protocol or service family is reachable from the public internet, so that an organization can judge whether its own architecture is an outlier. Using ZoomEye, a query for EtherNet/IP — the industrial protocol commonly associated with Rockwell Automation controllers and exposed on TCP port 44818 — returns a substantial global footprint:

port="44818" && service="ethernet-ip"

At the time of collection (2026-09-15), this query returned 41,601 matching assets. A separate query for Modbus, another widely deployed industrial protocol on TCP port 502, returned 37,792 assets:

port="502" && service="modbus"

A narrower query combining Modbus service identification with a U.S. country filter returned 5,118 assets, and a port-only U.S. query returned 4,745. These figures describe protocol and service exposure, not confirmed compromise and not confirmed vulnerability. EtherNet/IP and Modbus are legitimate, widely used industrial protocols; their presence on the public internet is the condition CISA is warning about, not evidence that any given asset has been attacked.
One negative result is also informative. A query for a specific controller fingerprint returned no matches:

app="Rockwell Automation MicroLogix 1400"   → 0
app="Rockwell Automation"                    → 86

The absence of a large, precise fingerprint count for the named controller model is a useful caution. A product name appearing in an advisory does not mean ZoomEye maintains a matching application fingerprint for it. Broad vendor-level fingerprints and protocol-level queries answer different questions, and the protocol-level view is the more reliable indicator of reachable industrial surface.

What the numbers do and do not show

The counts above are observations of internet-reachable assets matching a protocol or service signature at a point in time. They do not establish that those assets belong to water utilities, that they are unpatched, or that they have been targeted. ZoomEye's geographic and industry fields can narrow a search, but a zero result for a combined industry-and-port query — as seen with industry="water" && port="44818" returning 0 — should be read as a limitation of the available classification data, not as proof that no water-sector OT is exposed.
The defensible conclusion is narrower and still useful: a very large number of industrial protocol endpoints are reachable from the public internet, and CISA is reporting active targeting of exactly this kind of exposure in one critical sector. Any organization that cannot account for every one of its internet-facing OT connections — including cellular modems and vendor-installed remote access — has an unmeasured risk.

Practical next steps

1. Inventory external OT connections. Treat undocumented cellular modems and vendor remote-access links as in scope. CISA's warning about unmanaged modems is a direct prompt to reconcile what is actually connected against what is documented.
2. Remove direct internet exposure. Route operational remote access through a VPN or gateway rather than exposing the controller. This is CISA's primary recommendation.
3. Harden authentication. Enable password protection, replace default passwords, and allowlist the specific IPs permitted to reach OT assets.
4. Preserve recovery options. Keep a known clean backup of PLC images so that a modified password does not force a choice between lockout and unsafe recovery.
5. Use exposure data to scope the problem. Protocol- and service-level queries in ZoomEye help establish whether an organization's external footprint is typical or unusually large, and where to focus verification. CISA's alert is ultimately about reachability. The mitigations it recommends are architectural, and the measurement problem it implies — knowing what is exposed — is one that internet-wide search can help frame, provided the results are read for what they are: exposure observations, not proof of compromise. ## References
6. CISA, "CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs," 30 July 2026. https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs
7. CISA, "Primary Mitigations to Reduce Cyber Threats to Operational Technology."
8. UK National Cyber Security Centre, "Secure Connectivity Principles for Operational Technology."
9. FBI, "Malicious Cyber Actors Targeting Water and Wastewater Sector Internet Facing Programmable Logic Controllers, Causing Operational Disruptions."
10. ZoomEye exposure queries executed 2026-09-15: port="44818" && service="ethernet-ip" (41,601); port="502" && service="modbus" (37,792); service="modbus" && country="US" (5,118); port="502" && country="US" (4,745); app="Rockwell Automation" (86); app="Rockwell Automation MicroLogix 1400" (0); industry="water" && port="44818" (0).