Over 4,400 Rockwell PLCs Exposed Online, 22 Found in Water Attack Cities

Malicious cyber actors are actively targeting exposed Rockwell Automation Programmable Logic Controllers, with Forescout identifying 22 units located in US cities recently affected by water utility cyberattacks. These attackers altered IP addresses and set passwords on the controllers, causing operational disruptions without necessarily exploiting specific vulnerabilities. Of these targeted devices, 19 run firmware vulnerable to CVE-2017-16740, a Modbus TCP buffer overflow affecting MicroLogix 1400 Series B and C. A broader scan revealed over 4,400 such controllers accessible from the public internet worldwide.