Securing Siemens PLCs Without Shutting Down the Factory
US agencies are warning that industrial controllers running critical infrastructure are being actively targeted. The advice is sound. Applying it carelessly could cause the very outages attackers are hoping for.
Key points
- Five US agencies, including CISA and the NSA, issued joint advisory AA26-231A on August 19, warning of active attacks on Siemens S7 programmable logic controllers.
- Criminals are using internet-scanning tools combined with AI-assisted scripts to find and probe exposed controllers at water plants, power facilities, and manufacturing sites.
- The advisory covers Siemens S7-200, S7-300, S7-400, S7-1200, and S7-1500 series controllers, including safety-rated variants.
- Siemens confirmed that AA26-231A describes no new vulnerabilities; the risk comes from known misconfigurations and poor network setup.
- Several of the agencies' recommended fixes can knock a plant offline if applied without first understanding how that specific facility is wired together.
A Siemens S7 is a programmable logic controller: a small industrial computer that runs physical machinery at water treatment plants, power stations, chemical sites, and production lines. It doesn't run spreadsheets. It opens valves, controls motors. Getting the configuration wrong doesn't mean a slow website. It can mean an unplanned shutdown.
On August 19, the NSA, CISA (the US Cybersecurity and Infrastructure Security Agency), the FBI, the Department of Energy, and the Environmental Protection Agency jointly published advisory AA26-231A. Their message: criminals are actively scanning the internet for exposed S7 controllers and using those footholds to read or alter control logic. We reported on the advisory the day it dropped, in our story on attackers using AI to break into Siemens factory controllers; this piece is about how to act on the guidance without creating new problems.
How are the attackers getting in?
The criminals aren't exploiting a single secret flaw. They're finding controllers that were never properly hidden from the internet, then using freely available tools to talk to them.
The tool most mentioned in the advisory is Snap7, an open-source library that speaks the S7's native protocol, S7comm, which typically runs over TCP port 102 (port 102 being a numbered doorway on a network connection). Snap7 is legitimate software used by engineers every day. In the wrong hands it can read or overwrite memory and control logic inside a PLC. The agencies say attackers are now using AI to write their scanning scripts faster, though the root problem isn't AI. It's that too many controllers are reachable from the public internet at all.
Siemens told German trade publication Produktion that the advisory describes no new S7 vulnerabilities. Its updated security bulletin, SSB-104599, points customers to current software, protected networks, and strong passwords.
Should plant operators just apply all the patches at once?
No, and this is the part that deserves real attention. Every recommendation in the advisory is reasonable in principle. Several can break production if applied without understanding the specific plant.
The guidance recommends disabling unused services, including the PROFINET protocol (a standard that connects the controller to remote sensors, drives, and other equipment) and Modbus TCP (a communication method used by meters, analysers, and third-party machinery). But "unused" has to be proved, not assumed. A service that looks quiet for ten minutes may only carry traffic during startup, shutdown, or a failover event. Switch it off and the plant may lose its remote sensors mid-shift.
The same caution applies to firmware updates. A firmware change on an S7 can affect attached modules, HMI screens (the touchscreen displays operators use to monitor the process), third-party integrations, and safety functions. A project backup may not reverse the change. Downgrading is sometimes impossible.
| Hardening step | What can break | Safer approach |
|---|---|---|
| Block TCP port 102 | HMI and engineering access | Block at the perimeter only; allow known pairs internally |
| Disable PROFINET or Modbus TCP | Remote sensors, drives, third-party kit | Check project config and watch live traffic first |
| Disable the web server | Browser-based diagnostics | Confirm actual use; if needed, restrict to a maintenance network |
| Apply firmware update | Modules, safety functions, libraries | Test the exact hardware combination before deploying |
| Enable MAC/IP allowlisting | Not available on older CPUs | Enforce equivalent rules at the network boundary instead |
The safest first move is the network edge. Blocking port 102 at the perimeter firewall, the boundary between the plant network and the outside world, cuts off the most common attack path without touching anything inside the facility.
What should ordinary people take from this?
Most readers won't operate an S7 controller personally. But the facilities these controllers run supply drinking water, electricity, and the goods in shops. A disruption caused by an attacker, or by a well-meaning but rushed security fix, affects all of that. Context worth keeping: our earlier story on July's wave of attacks on water systems found over 100 internet-connected facilities targeted in a single month, most left exposed by a simple modem. The S7 advisory is the same problem at a different layer of the stack.
If you work in industrial operations, the practical point is this: treat every hardening change as a formal engineering change. Identify the exact controller model, confirm which services are genuinely unused, test in a representative environment, and have a rollback plan agreed before the maintenance window opens. The advisory and Siemens' guidance are the right starting points, not a checklist to tick off before lunch.
