Over 4,400 Rockwell PLCs Exposed Online, 22 Found in Water Attack Cities

Forescout discovered thousands of internet-facing Rockwell/Allen-Bradley PLCs (4,407 globally, ~2,844 in the US) and identified 22 controllers in cities affected by recent water utility incidents; attackers reportedly changed IP addresses and set passwords on reachable devices, causing loss of visibility and control. The report highlights unauthenticated exposure via EtherNet/IP (port 44818), notes many devices are on mobile carrier networks, references CVE-2017-16740 affecting MicroLogix 1400/1100 firmware, and relays FBI/EPA guidance to remove public exposure, enforce strong authentication, patch firmware, and isolate cellular remote access.