From Reachable to Urgent: A Prioritisation Method for Internet-Exposed PLCs After the CISA Water Sector Alert

CISA's 30 July 2026 alert on activity targeting programmable logic controllers in the Water and Wastewater Systems Sector ends with a short list of mitigations. Disconnect the PLC from the internet. Route remote access through a VPN or gateway. Enable password protection and change default passwords. Allowlist IP addresses. Keep a known clean backup of the PLC image.
The list is short, but applying it across a real utility estate raises an immediate problem: not every exposed controller carries the same risk, and the alert does not rank them. A prioritisation method is needed, and it has to be built from properties that can actually be observed or verified rather than assumed.

What the alert tells us about the threat

The described activity is operational rather than exploit-based. Threat actors reached exposed PLCs, modified passwords to lock out operators, and changed IP addresses to disconnect the devices. CISA states that this resulted in boil water notices and sustained manual operations, and that entities of all sizes were targeted.
Two properties of that description drive prioritisation. First, the attacker's advantage comes from reachability plus weak access control, not from a specific software flaw. Second, the operational impact is immediate and physical: a locked-out controller means manual operation, and in the water sector that can mean a boil water notice.
CISA also warns that even organizations with mature cybersecurity processes should validate their external connections, because the targeting includes cellular modems installed by operators, vendors, or system integrators that may not be documented or included in routine attack surface scans.

A four-tier prioritisation model

The tiers below are ordered by how directly each condition maps to the described attack path. They are a triage aid, not a compliance standard.
Tier 1: Directly reachable controller with default or shared credentials. This is the closest match to the reported activity. The device answers on the public internet, and access control is weak enough that an actor who reaches it can change the password or the network configuration. Remediation is immediate: remove the direct exposure, rotate credentials, and confirm the change from outside the network.
Tier 2: Directly reachable controller with strong, unique credentials. The exposure remains, but the specific described action is harder. The priority is to remove the direct path anyway, because reachability exposes the device to other techniques and to future flaws. CISA's guidance does not distinguish this case from Tier 1.
Tier 3: Controller reachable only through a VPN or gateway, with the gateway itself exposed. This is the configuration CISA recommends, but the security now depends on the gateway. Verify that the gateway enforces authentication, that its software is current, and that access is limited to known engineering laptops or critical OT assets as the alert recommends.
Tier 4: Controller with no external path, but with an undocumented remote-access device present. CISA's note about cellular modems belongs here. The controller may not answer a scan, yet a modem installed by a vendor or integrator may provide a path that no scan and no asset register currently shows. The action is discovery: find the modems, document them, and bring them under the same access-control rules as everything else.

Using external observation to seed the triage

Tier assignment starts with knowing which assets are externally reachable. A protocol query provides that starting set. On 17 September 2026, the query

port="44818" && service="ethernet-ip"

returned 41,601 assets globally, and restricting the same query to one country returned 19,977. Those figures describe the global and national EtherNet/IP surface; they say nothing about which of those assets belong to a given utility.
The operationally useful form of the query is the same protocol filter restricted to the organization's own public address ranges. Every match is then a candidate for Tier 1 or Tier 2 and needs an owner, a purpose, and a documented access path. A match that cannot be tied to a known asset moves up the queue, because an unexplained external connection is precisely the condition the alert describes.
Attempts to shortcut the triage by searching for the named controller model directly were not productive. Queries for app="MicroLogix 1400", app="Rockwell Automation MicroLogix 1400", and module_id="1766-L32BWA" each returned zero results on the same day. That is a statement about fingerprint availability in a lean industrial protocol, not evidence that such devices are absent. It means prioritisation should be driven by reachability and access control, and that model-level inventory has to come from the operator.

Ordering the work

A practical sequence follows from the tiers.

1. Enumerate public address ranges, including ranges used by vendors and integrators, and include cellular links.
2. Run the protocol query against those ranges and record the results with a timestamp.
3. Classify each match by access path: direct, gateway-mediated, or unexplained.
4. For direct matches, verify credential state and remove the direct path, then confirm removal by re-running the query.
5. For gateway-mediated matches, audit the gateway rather than the controller.
6. For unexplained matches, investigate before remediating, since an unknown device may belong to a third party whose disconnection has operational consequences.
7. Record a clean PLC image backup for any controller that could be locked out, as CISA advises. ZoomEye's role in this sequence is steps 2, 4, and the ongoing verification that a remediation actually removed the external path. That last point is where external observation adds something an internal checklist cannot: a firewall rule change can be recorded as complete while the device remains reachable through a second path. ## Limitations The tier model is a reasoning aid derived from the alert's description of attacker behaviour; it is not published guidance from CISA or any other authority. Exposure counts cited here are single-day observations from 17 September 2026 and depend on probe coverage. A device that does not respond to external probes may still be reachable through a path that this method does not observe, which is why CISA's caution about undocumented cellular modems matters. No count in this article identifies a specific utility, a compromised device, or an exploited vulnerability. ## References
8. CISA, "CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs," 30 July 2026. https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs
9. ZoomEye queries executed 17 September 2026, counts as recorded above.