Back Scworld

Internet-exposed Modbus ICS devices threaten critical infrastructure | brief

Scworld • April 9, 2026

Internet-facing industrial control devices connected to the default Modbus port, commonly used by power grids and other industrial systems, reached 179 across 20 countries despite the protocol's absence of encryption and authentication, indicating a significant risk to critical infrastructure entities, Cybernews reports.

Most of the exposed ICS devices were in the U.S., followed by Sweden and Turkey, with one of the devices discovered to be included in a national railway network and a pair of devices found to be included in the power grid infrastructure of an Asian and a European country, according to Comparitech researchers. Schneider accounted for most of the devices that touted their manufacturer, followed by Data Electronics and ABB Stotz-Kontakt.

"Even if a device isn't obviously linked to a particular manufacturer, attackers may make an educated guess as to what its registers relate to, particularly if they monitor how they change over time. Because Modbus doesn't require authentication, an attacker could potentially write to, as well as read from, the holding registers," said researchers.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Exposed Modbus ICS Devices Heighten Risks to Critical Infrastructure A report reveals that 179 internet-exposed industrial control systems (ICS) using the Modbus protocol are vulnerable across 20 countries, with the majority located in the U.S., Sweden, and Turkey. The Modbus protocol lacks encryption and authentication, making these devices susceptible to unauthorized access and manipulation. Notably, one device is part of a national railway network, while others are linked to power grid infrastructures in both Asia and Europe. Researchers from Comparitech warn that attackers can exploit these vulnerabilities to read and write to holding registers without authentication. The presence of malware targeting ICS, such as Stuxnet and Industroyer, further exacerbates the risk of disruption and sabotage. The findings indicate a significant threat to critical infrastructure entities, necessitating immediate attention from security professionals. 4 sources 68

Internet-exposed Modbus ICS devices threaten critical infrastructure | brief

The full story

Extracted Entities

Countries (2)

Platforms (1)