Forescout found 22 internet-facing Rockwell Automation programmable logic controllers (PLCs) in cities hit by recent cyberattacks on US water utilities. Nineteen used the same mobile carrier network.
Its August 3 scan counted 4,407 exposed Rockwell controllers worldwide, including 2,844 in the United States, but Forescout could not confirm any were compromised. That figure counts exposed controllers, not water utilities or confirmed victims.
Forescout said the publicly described effects could be achieved without a vulnerability exploit: attackers changed IP addresses and set passwords on controllers that were already reachable, causing operators to lose visibility and, in some cases, control of connected equipment.
Neither the government alerts nor Forescout’s analysis explains how the attackers found, selected, or initially accessed their targets.
Water and wastewater utilities in at least seven states have reported incidents since July 27, the FBI and EPA said in a July 30 public service announcement. The Hacker News found on August 6 that Forescout’s post says the announcement confirmed at least 12 states, while the FBI page says seven. No agency has attributed the campaign.
Whatever the final count, defenders can act now by taking the controllers off the public internet.
Exposing EtherNet/IP on port 44818 creates an unauthenticated path that, depending on device configuration, lets an attacker identify a controller or write settings to it, Forescout said.
Forescout found more than 70% of the US-based exposed controllers on large mobile carrier networks. The FBI and EPA recommend strong authentication, updates and logging for cellular modems, with remote access isolated through a private APN, VPN or similar architecture.
A July 30 Censys snapshot found 4,148 exposed Rockwell/Allen-Bradley EtherNet/IP hosts, with Verizon Business, AT&T Mobility and T-Mobile USA accounting for 59%. The Censys and Forescout snapshots both exceed 4,100 hosts, but different platforms, queries and dates make the figures not directly comparable. Forescout’s historical series hit a June 2026 low of 4,169, down 47% from 7,814 in March 2020; its August 3 snapshot was 4,407.
MicroLogix 1400 devices made up 50% of Forescout’s results and MicroLogix 1100 devices 8%. The FBI and EPA named both families. Forescout said 19 of the 22 controllers in affected cities ran firmware susceptible to CVE-2017-16740 (Rockwell CVSS score: 8.6).
The flaw is a Modbus TCP buffer overflow affecting MicroLogix 1400 Series B and C running firmware 21.002 and earlier; Rockwell fixed it in revision 21.003. Exploitation requires Modbus TCP to be enabled, which Forescout could not verify on those hosts. Firmware updates address specific bugs but “do not make direct public exposure of PLCs acceptable,” the researchers wrote.
Rockwell discontinued the MicroLogix 1100 on April 30, 2022. Advisory SD1790 tells operators locked out by an attacker-set password how to reset a MicroLogix 1400 or 1100 to factory defaults and redownload a known-good project file. The notice carries no CVE because it is recovery guidance, not a vulnerability disclosure.
That recovery path requires a current offline copy of the controller logic. The FBI said at least one victim found modified PLC project files after spotting ladder logic discrepancies across several sites. It also warned that similar third-party network setups may let attackers repeat successful compromises across customers sharing vulnerable configurations.
