A scan conducted via the Shodan search engine found approximately 4,400 internet-exposed programmable logic controllers (PLCs) from Rockwell Automation's Allen-Bradley brand, primarily MicroLogix 1400, MicroLogix 1100, CompactLogix 1769, and ControlLogix 5590 models. Of these, 2,844 are located in the United States, including 22 in cities recently affected by cyberattacks on water systems. The exposed devices communicate using the EtherNet/IP protocol, which, when publicly accessible, can allow external actors to identify devices and potentially alter configurations. The FBI and EPA have issued advisories confirming attacks on water and wastewater utilities in at least 12 states since late July 2026, with some attacks resulting in operational impacts such as pressure loss and flooding. Research indicates that 19 of the 22 exposed devices in affected cities may be vulnerable to CVE-2017-16740, a remote code execution vulnerability requiring Modbus TCP enabled, though it is unclear if this protocol is active on those devices. The attacks appear to be opportunistic mass scanning rather than targeted campaigns with zero-day exploits. Despite longstanding warnings from manufacturers and federal agencies since 2018, these controllers remain exposed online, increasing the risk of exploitation.

The exposure of thousands of industrial controllers used in critical water and wastewater infrastructure increases the risk of unauthorized remote access and manipulation. Confirmed attacks have caused operational disruptions such as pressure loss and flooding in affected utilities. The presence of devices vulnerable to a known remote code execution flaw (CVE-2017-16740) further elevates the risk, although exploitation requires specific protocol configurations. The attacks are currently characterized as opportunistic mass scanning rather than sophisticated targeted intrusions. The continued exposure despite federal warnings indicates a persistent security gap in critical infrastructure protection.

Federal agencies and manufacturers have advised against placing industrial controllers directly on the public internet. Operators should immediately assess and restrict internet exposure of PLCs, especially those using EtherNet/IP and Modbus TCP protocols. Applying network segmentation and access controls to isolate these devices from public networks is critical. For devices vulnerable to CVE-2017-16740, ensure that Modbus TCP is disabled if not required, and apply any available patches or mitigations from Rockwell Automation. Monitoring for unauthorized configuration changes and reviewing remote access policies are recommended. Since no specific patch status is provided, check Rockwell Automation advisories for updates. The vendor and federal agencies manage remediation guidance; operators should follow official advisories closely.