Forescout’s Vedere Labs published research on August 6, 2026 quantifying an attack surface that CISA’s July 30 water-sector advisory only described in general terms. An internet-wide scan conducted on August 3 identified 4,407 Rockwell Automation and Allen-Bradley programmable logic controllers reachable on port 44818 — the TCP port used by EtherNet/IP and CIP (Common Industrial Protocol) — with 2,844 of them, roughly 65 percent, located in the United States.
The research matters because it moves the water-sector PLC targeting campaign from anecdote to measurement. CISA and the FBI had confirmed that threat actors were reconfiguring internet-exposed PLCs at water and wastewater utilities across at least seven states, later reported by ABC News to have grown to 12. What Forescout adds is a device-level census: which controllers are exposed, where, and whether they carry known exploitable defects on top of being reachable in the first place.
22 Controllers, 19 With a Nine-Year-Old Flaw
Cross-referencing its exposure data against the cities named in water-sector incident reporting, Forescout identified 22 internet-facing Rockwell PLCs located specifically in affected municipalities. Of those 22, nineteen were running MicroLogix 1400 firmware vulnerable to CVE-2017-16740 — a Modbus TCP buffer overflow affecting MicroLogix 1400 Series B and C controllers on firmware 21.002 and earlier. Rockwell shipped a fix in firmware revision 21.003 back in 2017. The vulnerability carries a CVSS v3 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) — network-exploitable, low attack complexity, no privileges or user interaction required, with a high availability impact and a scope change into connected systems.
Nine years between patch availability and exposed, unpatched instances turning up in cities under active attack is not an outlier in OT — it is close to the sector norm. MicroLogix controllers are frequently deployed as “set and forget” field devices at lift stations, treatment skids, and remote pump houses where firmware updates require a site visit, a maintenance window, and confidence that the update won’t disrupt an already-fragile control loop.
Device Population: MicroLogix Dominates
Forescout’s breakdown of the 4,407 exposed devices by product family:
- MicroLogix 1400 — 50 percent
- CompactLogix 1769 — 22 percent
- MicroLogix 1100 — 8 percent
- ControlLogix 5590 — 8 percent
- Remaining share split across other Logix and MicroLogix variants
MicroLogix 1100 and 1400 are the two families the FBI specifically named as the devices targeted in the water-sector campaign, which tracks with their combined 58 percent share of the exposed population. Notably, exploitation of CVE-2017-16740 requires Modbus TCP to be enabled on the controller — a configuration setting Forescout could not verify remotely across the exposed hosts, meaning the 19 flagged devices represent a plausible-but-unconfirmed subset rather than a confirmed-vulnerable count.
Attackers Didn’t Need the CVE
The more consequential finding in the report is that the observed water-sector attacks did not require CVE-2017-16740 or any other exploit at all. Forescout’s analysis states plainly that the operational effects reported by utilities — loss of visibility, pressure anomalies, lockouts — were achievable through direct, authenticated access to controllers that were already reachable without a VPN, firewall rule, or network segmentation boundary standing between them and the public internet. Attackers reconfigured device IP addresses and overwrote operator passwords using native engineering-access functions, not memory-corruption exploits.
This distinction matters operationally: patching CVE-2017-16740 alone does not close the exposure. A fully patched MicroLogix 1400 sitting on port 44818 with EtherNet/IP or Modbus TCP reachable from the internet, protected only by a device password, remains trivially reconfigurable by anyone who can reach it. The vulnerability compounds the exposure — a memory-corruption bug is a more severe fallback if credentials are hardened — but exposure itself is the root cause.
Operational Guidance for Asset Owners
For water and wastewater operators running Rockwell/Allen-Bradley controllers, or any integrator supporting them, the actions that follow from this research are unambiguous:
- Remove port 44818 (and Modbus TCP port 502) from internet reachability. No CIP or Modbus TCP interface on a field-deployed PLC should answer to unsolicited traffic from outside the utility’s network. Use a VPN concentrator or jump host with MFA for any legitimate remote engineering access, never direct exposure.
- Inventory MicroLogix 1100/1400 firmware versions. Confirm firmware is at or above revision 21.003 for MicroLogix 1400 Series B/C. Rockwell’s Product Compatibility and Download Center (PCDC) hosts the patched firmware and release notes for CVE-2017-16740.
- Change default and long-static passwords on CIP-connected devices, and rotate them on a defined schedule — not just at commissioning.
- Monitor for unexpected IP address or password changes on field controllers; these are the specific indicators observed in the July campaign and are detectable via passive OT network monitoring or periodic active polling.
- Cellular-connected RTUs and PLCs deserve particular scrutiny. Many smaller utilities rely on cellular modems for remote sites specifically because they bypass conventional network perimeter controls — and that bypass is exactly what routine attack-surface scanning tends to miss.
Forescout’s scan methodology — passive internet-wide enumeration cross-referenced against known incident locations — is a useful template for any utility wanting to self-assess before an adversary does the same census. A device that shows up in a Shodan or Censys query for port 44818 or 502 is a device an attacker has already found.