Sizing the Industrial Control Surface: What 41,601 Reachable EtherNet/IP Endpoints Tell Us About OT Exposure

When CISA warned on 30 July 2026 that threat actors were targeting internet-exposed PLCs in the Water and Wastewater Systems Sector, the alert described outcomes rather than statistics. Attackers modified passwords to lock out operators, changed IP addresses to disconnect devices, and the result was boil water notices and sustained manual operations. No aggregate exposure figure accompanied the alert.
That gap is where measurement becomes useful, provided the measurement is read carefully. Exposure counts describe how much of a protocol surface is reachable from the public internet. They do not describe how much of it is in scope for a specific incident, and the difference between those two statements is the whole discipline.

The measured surface

Queries executed on 17 September 2026 against ZoomEye produced the following observations for the EtherNet/IP protocol associated with the controllers named in the alert.
| Query | Count | Query time (UTC) |
| --- | ---: | --- |
| port="44818" && service="ethernet-ip" | 41,601 | 2026-09-17 05:39 |
| service="ethernet-ip" | 41,609 | 2026-09-17 05:39 |
| port="44818" | 41,965 | 2026-09-17 05:39 |
| port="44818" && country="US" | 19,977 | 2026-09-17 05:39 |
The first three rows converge because TCP port 44818 is the registered EtherNet/IP port. The service fingerprint and the port number describe nearly the same population, and the small differences reflect assets where one signal is present without the other.
The fourth row is the more interesting one for scoping. Roughly 48 percent of the observed EtherNet/IP surface sits in the United States. That is a geographic observation, not a sector observation. EtherNet/IP is deployed in manufacturing, food processing, building automation, and process industries, and the WWS Sector is only one part of that population.

Reading a count without overreading it

There are four distinct claims that a count like 41,601 does not support.
It does not mean 41,601 water utilities are exposed. It means 41,601 assets answered an EtherNet/IP probe. The sector distribution of that population is unknown from the query alone.
It does not mean 41,601 devices are vulnerable. The alert describes operational abuse of reachable controllers, including password modification and IP reconfiguration. Those are actions available to an actor who can reach a device with weak or default access controls; they are not a software defect with a fixed list of affected versions.
It does not mean 41,601 devices have been attacked. CISA reported observing increased targeting activity and described its consequences. It did not publish a victim count, and the exposure figure is not a substitute for one.
It does not mean the number is stable. Devices are connected and disconnected continuously, and a scan index reflects what was observed at a point in time.

Why the surface persists

The persistence of this exposure has structural causes rather than careless ones. Remote engineering access is genuinely useful: a controller at a remote pumping station may need vendor support, and a cellular modem installed by a system integrator can provide that access without a site visit. CISA's alert explicitly notes that the targeting includes cellular modems that may not be documented or included in routine attack surface scans.
The agency's recommended mitigations are correspondingly architectural: disconnect the PLC from the internet, route remote access through a VPN or gateway rather than directly to the controller, enable password protection and change default passwords, and allowlist IP addresses so that only known engineering laptops or critical OT assets can connect. It also advises operators to keep a known clean backup of the PLC image in case a modified password locks them out.
Each of those mitigations reduces the reachable surface. None of them is a scan result, and none can be verified from outside the network.

Using the measurement as a baseline, not a verdict

For an organization that wants to act on the alert, the productive use of an exposure count is comparative. Establish the protocol query as a baseline over the address ranges the organization controls, record the count and the observation date, and repeat it on a schedule. Movement in that number is actionable: a new match in a range that previously had none is a new external connection, and it deserves an owner and a justification.
The same logic applies at a portfolio level. A security team responsible for several sites can use a single protocol query restricted to each site's public ranges to produce a consistent, comparable view across sites, rather than relying on site-by-site documentation that may be out of date.
ZoomEye's contribution here is a repeatable external observation of protocol reachability. It supplies the baseline against which change can be detected. It does not supply the industry classification, the ownership, or the compromise status of any individual asset, and treating an exposure count as evidence of any of those would be a misreading of the data.

Limitations

All counts in this article are single-day observations from 17 September 2026 and are subject to index drift and probe coverage limits. Country attribution reflects the observed network location of the responding asset, which may differ from the location of the operator. The queries measure protocol reachability and service fingerprinting only; they do not measure authentication configuration, firmware state, or whether a device is protected by a gateway. No conclusion about a specific utility, device, or incident should be drawn from an aggregate count.

References

• CISA, "CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs," 30 July 2026. https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs
• ZoomEye queries executed 17 September 2026, counts as recorded above.