Forescout Finds 4,000+ Exposed Rockwell Controllers, Including 22 in Attack-Affected Cities
Summary
Forescout found over 4,000 Rockwell and Allen-Bradley controllers exposed online, including 22 in cities affected by recent water-system attacks. Researchers said 19 may be vulnerable to CVE-2017-16740, but could not confirm whether the required Modbus TCP was enabled.
Key points
- Forescout’s Vedere Labs found more than 4,000 internet-exposed Rockwell Automation and Allen-Bradley controllers; 2,844 were in the United States.
- Twenty-two exposed devices were in cities affected by recent water-system attacks, but Forescout did not establish that the devices belonged to affected utilities or had been attacked.
- Nineteen of those 22 devices appeared vulnerable to CVE-2017-16740 based on firmware, but researchers could not confirm whether Modbus TCP was enabled, a requirement to exploit the flaw.
- Publicly exposed EtherNet/IP devices may be identifiable and, depending on configuration, could allow settings or configurations to be changed.
- A federal advisory described attacks on MicroLogix 1100 and 1400 PLCs, including one case involving remote changes to IP addresses and passwords that disrupted a utility’s control and visibility.
- Forescout did not attribute the attacks to an actor; the researchers also found expired certificates, unrenewed remote-access web addresses, and apparently abandoned servers.
Article Details
- Event Type
- Forescout scan of internet-exposed industrial controllers amid reported water and wastewater utility cyberattacks
- Impact
- Forescout found more than 4,000 Rockwell Automation and Allen-Bradley controllers exposed online, including 22 in cities affected by recent attacks; it did not establish that those devices belonged to affected utilities or had been attacked. Based on firmware versions, 19 of the 22 appeared potentially vulnerable to CVE-2017-16740, but exploitation requires Modbus TCP to be enabled, which researchers could not confirm. Separately, an advisory described attacks in which attackers remotely changed controllers’ IP addresses and passwords, disrupting utility visibility and control and causing pressure loss and flooding.
CVE
People
Vendors
Products
CompactLogix 1769Other versions, such as AllenBradley’s CompactLogix 1769 controllers, made up 22%.ControlLogix 5590MicroLogix 1100 and ControlLogix 5590 devices each accounted for about 8%.MicroLogix 1100The advisory said attackers targeted programmable logic controllers (PLCs) made by Rockwell Automation under its Allen-Bradley brand, specifically the MicroLogix 1100 and 1400 models.MicroLogix 1400The research highlights ongoing risks from public-facing EtherNet/IP devices, stale remote-access services, and possible exposure to CVE-2017-16740 on some MicroLogix 1400 systems.