Securing Siemens PLCs Without Shutting Down the Factory
US agencies are warning that industrial controllers running critical infrastructure are being actively targeted. The advice is sound. Applying it carelessly could cause the very outages attackers are hoping for.
Key points
- Five US agencies, including CISA and the NSA, issued joint advisory AA26-231A on August 19, warning of active attacks on Siemens S7 programmable logic controllers.
- Criminals are using internet-scanning tools combined with AI-assisted scripts to find and probe exposed controllers at water plants, power facilities, and other critical sites.
- The advisory covers Siemens S7-200, S7-300, S7-400, S7-1200, and S7-1500 series controllers, including safety-rated variants.
- Siemens confirmed that AA26-231A describes no new vulnerabilities; the risk comes from known misconfigurations and poor network setup.
- Several of the agencies' recommended fixes can knock a plant offline if applied without first understanding how that specific facility is wired together.
A Siemens S7 is a programmable logic controller, meaning a small industrial computer that runs the physical machinery at water treatment plants, power stations, chemical facilities, and manufacturing lines. It does not run spreadsheets. It opens valves, controls motors, and tells safety systems when to cut power. Getting the configuration wrong does not mean a slow website. It can mean an unplanned shutdown.
On August 19, the NSA, CISA (the US Cybersecurity and Infrastructure Security Agency), the FBI, the Department of Energy, and the Environmental Protection Agency jointly published advisory AA26-231A. Their message: criminals are actively scanning the internet for exposed S7 controllers and using those footholds to read or alter control logic.
How are the attackers getting in?
The criminals are not exploiting a single secret flaw. They are finding controllers that were never properly hidden from the internet, then using freely available tools to talk to them.
The tool most mentioned in the advisory is Snap7, an open-source library that speaks the S7's native language, a protocol called S7comm that typically runs over TCP port 102 (port 102 being a numbered doorway on a network connection). Snap7 is legitimate software used by engineers every day. In the wrong hands, it can read or overwrite the memory and control logic inside a PLC. The agencies say attackers are now using AI to write their scanning scripts faster, though the root problem is not AI. It is that too many controllers are reachable from the public internet at all.
Simemens told German trade publication Produktion that the advisory describes no new S7 vulnerabilities. Its own updated security bulletin, SSB-104599, points customers to current software versions, protected networks, and strong passwords.
Should plant operators just apply all the patches at once?
No, and this is the part that deserves real attention. Every recommendation in the advisory is reasonable in principle. Several can break production if applied without understanding the specific plant.
Take one example: the guidance recommends disabling unused services, including the PROFINET protocol (a standard that connects the controller to remote sensors, drives, and other equipment) and Modbus TCP (a communication method used by meters, analysers, and third-party machinery). But "unused" has to be proved, not assumed. A service that looks quiet for ten minutes may only carry traffic during startup, shutdown, or a failover event. Switch it off and the plant may lose its remote sensors mid-shift.
The same caution applies to firmware updates. Updating the controller software is good practice, but a firmware change on an S7 can affect attached modules, HMI screens (the touchscreen displays operators use to monitor the process), third-party integrations, and safety functions. A project backup may not reverse the change. Downgrading is sometimes impossible.
| Hardening step | What can break | Safer approach |
|---|---|---|
| Block TCP port 102 | HMI and engineering access | Block at the perimeter only; allow known pairs internally |
| Disable PROFINET or Modbus TCP | Remote sensors, drives, third-party kit | Check project config and watch live traffic first |
| Disable the web server | Browser-based diagnostics | Confirm actual use; if needed, restrict to a maintenance network |
| Apply firmware update | Modules, safety functions, libraries | Test the exact hardware combination before deploying |
| Enable MAC/IP allowlisting | Not available on older CPUs | Enforce equivalent rules at the network boundary instead |
The safest first move is the network edge. Blocking port 102 at the perimeter firewall, the boundary between the plant network and the outside world, cuts off the most common attack path without touching anything inside the facility.
What should ordinary people take from this?
Most readers will not operate an S7 controller personally. But the facilities these controllers run supply drinking water, electricity, and manufactured goods. A disruption caused by an attacker, or by a well-meaning but rushed security fix, can affect all of those.
If you work in industrial operations or know someone who does, the practical takeaway is this: treat every hardening change as a formal engineering change. Identify the exact controller model, confirm which services are genuinely unused, test in a representative environment, and have a rollback plan agreed before the maintenance window opens. The advisory and Siemens' guidance are the right starting points, not a checklist to tick off before lunch.
