Release 2013-11

Vendors
Countries
Vendor Product WORLD IT CH Total
ABB Generic 3 0 0 0
RTU500 18 3 0 3
ACKP Generic 865 46 17 63
Adcon Telemetry A850 Telemetry Gateway 29 1 0 1
Generic 410 0 0 0
addUPI-OPC Server 891 6 0 6
Allen-Bradley Generic 137 0 0 0
Beck IPC IPC@CHIP 25405 4364 283 4647
BroadWeb Generic 359 0 0 0
Cimetrics Eplus - B/IP to B/WS Gateway Firewall 16 0 0 0
Clorius Controls Generic 12 0 0 0
Codesys WebVisu 635 48 635 683
Delta Controls enteliTOUCH 122 4 0 4
Echelon i.LON 600 5862 81 43 124
Electro Industries GaugeTech Generic 374 0 0 0
Elster EnergyICT Generic 2603 0 0 0
RTU 2595 0 0 0
eiPortal 1 0 0 0
Fujitsu ServerView 279 7 3 10
General Electric Cimplicity 219 27 1 28
Proficy 3 0 0 0
Generic Generic 12819 179 127 306
HMS EtherNet/IP / Modbus-TCP Interface 274 2 0 2
Moxa Generic 10748 824 83 907
ioLogik 168 0 0 0
NRG Systems WindCube 57157 1525 157 1682
Novatech Generic 0 0 0 0
RTS Services Generic 24 0 0 0
Rabbit Generic 9529 612 7 619
Reliance Reliance 4 SCADA/HMI system 4 0 0 0
Rockwell Automation Generic 195 5 1 6
Micrologix 6 0 0 0
SAP NetWeaver Application Server 2141 54 54 108
Schleifenbauer SPbus gateway 16 0 1 1
Schneider Electric CitectSCADA 5 1 0 1
Generic 1887 55 10 65
Modicon 226 2 3 5
PowerLogic ECC 1 0 0 0
PowerLogic EGX 22 1 0 1
PowerLogic ION 101 0 0 0
PowerLogic PM 119 1 3 4
Tac XENTA 913 9561 112 55 167
Siemens Generic 137194 597 493 1090
Scalance S 4 0 0 0
Scalance W 6 4 0 4
Scalance X 23 0 0 0
Simatic HMI 492 28 19 47
Simatic NET 260 16 30 46
Simatic S7 460 31 35 66
SoftPLC Generic 951 1 0 1
Somfy Generic 3070 0 3 3
SpiderControl Generic 1004 425 16 441
Stulz Generic 41 2 0 2
THUS Generic 4339 0 0 0
Trend IQ3xcite 3838 84 8 92
Tridium Generic 45940 995 295 1290
Wago Generic 315 37 155 192
Wind River Generic 165421 6894 205 7099
509199 17074 2742 19816

Abstract:

We found that half a million ICS and SCADA devices are exposed in public databases, at risk of attack. About 20'000 are present in Switzerland and Italy alone. Switzerland is more exposed that Italy in proportion, with 2'742 exposed devices on a total of 884'607, compared to 17'074 of Italy on a total of 6'299'498.

All data gathered during our research is published for further study.

1 Introduction

Welcome to the first release of ScadaExposure, an observatory on international reachability of ICS and SCADA devices.

The 2013-11 release is focused on answering the following questions:

  • Are ICS and SCADA devices correctly deployed and disconnected from public networks?
  • How many devices are exposed in Switzerland?
  • How many devices are exposed in Italy?
  • How is the Switzerland compared to Italy and vice-versa?
  • What is the possible impact?

2 Research method

We used a set of 95 dorks (search queries) against generic search engines (like Google and Bing) and specialized ones (like Shodan, who focus on indexing machines connected to the Internet). This represents the largest collection of search queries specialized in finding SCADA devices up to date. We did not only collected them, we improved the queries to get more and more solid results. For example some dorks were focusing on authentication banners, but in this way one will always and only get authentication protected devices, ignoring unauthenticated ones.

For each dork we performed several interrogations, dividing the results in three sets: Worldwide, to get the global presence of a particular device; CH, to limit the results to Switzerland; IT to limit the results to Italy. Switzerland and Italy were chosen as they are two neighbor nations and thus perfect for a comparative analysis.

Having distinct sets for different nations allows statistical and proportional comparison. We will add more countries in the future.

Dorks were then categorized in a taxonomy of Producers (we call them Vendors), Products and Versions. A dork can be linked to a Vendor, Product or Version or can be completely generic (like "PLC"). This allow us to obtain subtotals for every entity and know the actual usage and exposure rate.

3 Analysis

It's known that ICS and SCADA systems are a link between the digital and physical world so the consequences of malfunctioning can be definitely serious. It's also a fact that in complex systems even the failure of non-critical components can cause unplanned collateral damages.

The research is focused on demonstrating that such systems are not "air gapped" (deployed on a different, separated network) as many suggests, instead such devices are often exposed to random attackers from the Internet. This means that devices, thought to be completely isolated from external attackers, must be re-engineered with modern threat models.

Using our set of dorks we discovered a total of 509’199 SCADA devices, categorized in 29 Vendors and 62 Products. Switzerland accounted for 2’742 ICS devices on a total of 884’607 devices connected to Internet and indexed by our data sources. Italy accounted for 17’074 ICS devices on a total of 6’299’498 devices.

While Italy has 7 times the devices than Switzerland, we came to the conclusion that Switzerland has more exposed ICS devices in proportion. This means that the usage of SCADA elements is more pervasive and/or that their security is worse than in Italy. Speaking of absolute proportions Italy has 6.2 times more ICS devices than Switzerland, a number that is lower than 7.

Analysis between ICS/SCADA systems (Summary):

  • 3.3% of world’s SCADA devices are in Italy;
  • 0.5% of world’s SCADA devices are in Switzerland;
  • Italian and Swiss SCADA devices represent the 3.9% of the global exposure.

Our data moreover allows a comparison of ICS devices in a country versus the global total.

Analysis between ICS/SCADA systems and non-SCADA systems (Summary):

  • 0.27% of Italian exposed devices are SCADA;
  • 0.31% of total Swiss exposed devices are SCADA;
  • Switzerland is proportionally more exposed (+14.8%);
  • In Italy every 400 devices scanned one is SCADA;
  • In Switzerland every 330 devices scanned one is SCADA;

This means that randomly scanning 10 IP per second statistically you can find one exposed SCADAsystem per minute.

4 Conclusion

Now is time for answering the previously raised questions:

  • Are ICS and SCADA devices correctly deployed and disconnected from public networks?

    They are in many occasions not.

  • How many devices are exposed in Switzerland?

    Switzerland has 2’742 ICS devices exposed.

  • How many devices are exposed in Italy?

    Italy has 17’074 ICS devices exposed.

  • How is the Switzerland compared to Italy and vice-versa?

    Switzerland has more exposion (+14.8%) compared to Italy, although Italy has many exposed devices.

  • What is the possible impact?

    In a perfect world none of the found systems should be accessible by untrusted networks. With more than half a million of exposed devices, most of which belong to 10 most common Products, the risk connected to widespread exploitation and 0day attacks is high.

5 Known limitations

We did not connect to the found devices, it was not within the scope of the research and we do not publish specific IP addresses of targets, attackers already actively exploit such information. Publishing it would not add value to our research.

There is no assertion that systems are still reachable from the public Internet or vulnerable at all. They were indexed at some point by our datasources, and thus already exposed to the Internet. This alone represent a violation of most common security best practices, especially when it comes to ICS devices. Only information that seemed accurate and truthful was included in our results.

Search queries used to identify devices are not perfect and may overlap, resulting in larger subtotals and totals than the unique IP count, this may change with future releases if more resources are found to implement the needed screening and filtering.

It's impossible to know what these systems are connected to, and thus it's impossible to know the actual Risk. That's why to effectively assess Risk, Penetration Tests are used. They are real "simulations" of attacks, in the sense that targets are actually attacked but the test is executed in order to avoid deliberate damage. Again, no attack was performed against these devices.

Used datasources do not spider every possible device, they should be used as a statistical indication only. It can be easily understood that devices that appear in such databases have an increased chance to be attacked.

There are actually much more publicly accessible devices than the ones indexed by out datasources. We think that this compensate know limitations. Again, we were only looking for a statistical evidence to get educated conclusions.

6 Who and Why

All the research for this release has been performed by Francesco Ongaro and Gianluca Pericoli from ISGroup SRL, including building a platform that will serve for future studies and hopefully the creation of a more open ICS security community.

We started this research on request from Florian Imbach, a journalist of Sonntagszeitung, and decided to take it further because of the risk connected to insecure SCADA deployments, the little awareness and a great gap to fill compared to IT systems's security.

Our observatory represent a source to where people can refer to, citing actual numbers instead of vague feelings. There is no other public research comparable to ScadaExposure at the moment.

If you are a citizen you should require secure systems. If you are a company you should invest in the security of your production equipment. If you are a producer you should re-evaluate your products from a security prospective. If you are a security company you should sponsor this project to improve the awareness and overall security of ICS systems and infrastructures.

If you just want to contact us just write to scadaexposure@isgroup.it.

Vendor Product Version
ABBGenericGeneric
ABBRTU500RTU560
ACKPGenericGeneric
Adcon TelemetryA850 Telemetry Gateway Generic
Adcon TelemetryGenericGeneric
Adcon TelemetryaddUPI-OPC ServerGeneric
Allen-BradleyGenericGeneric
Beck IPCIPC@CHIPGeneric
BroadWebGenericGeneric
CimetricsEplus - B/IP to B/WS Gateway FirewallGeneric
Clorius ControlsGenericGeneric
CodesysWebVisuGeneric
Delta ControlsenteliTOUCHGeneric
Echeloni.LON 600Generic
Electro Industries GaugeTechGenericGeneric
Elster EnergyICTGenericGeneric
Elster EnergyICTRTUGeneric
Elster EnergyICTeiPortalGeneric
FujitsuServerViewGeneric
General ElectricCimplicityGeneric
General ElectricProficyGeneric
GenericGenericGeneric
HMSEtherNet/IP / Modbus-TCP Interface Generic
MoxaGenericGeneric
MoxaioLogikGeneric
NRG SystemsWindCubeGeneric
NovatechGenericGeneric
RTS ServicesGenericGeneric
RabbitGenericGeneric
RelianceReliance 4 SCADA/HMI systemGeneric
Rockwell AutomationGenericGeneric
Rockwell AutomationMicrologixGeneric
SAPNetWeaver Application ServerGeneric
SchleifenbauerSPbus gatewayGeneric
Schneider ElectricCitectSCADAGeneric
Schneider ElectricGenericGeneric
Schneider ElectricModiconM340
Schneider ElectricModiconGeneric
Schneider ElectricModiconM340
Schneider ElectricModiconGeneric
Schneider ElectricModiconM340
Schneider ElectricModiconGeneric
Schneider ElectricPowerLogic ECCECC21
Schneider ElectricPowerLogic EGXEGX100MG
Schneider ElectricPowerLogic IONGeneric
Schneider ElectricPowerLogic IONION8650
Schneider ElectricPowerLogic IONGeneric
Schneider ElectricPowerLogic IONION8650
Schneider ElectricPowerLogic IONGeneric
Schneider ElectricPowerLogic IONION8650
Schneider ElectricPowerLogic PMPM820SD
Schneider ElectricPowerLogic PMPM870SD
Schneider ElectricPowerLogic PMPM800
Schneider ElectricPowerLogic PMPM820SD
Schneider ElectricPowerLogic PMPM870SD
Schneider ElectricPowerLogic PMPM800
Schneider ElectricPowerLogic PMPM820SD
Schneider ElectricPowerLogic PMPM870SD
Schneider ElectricPowerLogic PMPM800
Schneider ElectricTac XENTA 913Generic
SiemensGenericGeneric
SiemensScalance SGeneric
SiemensScalance WGeneric
SiemensScalance XGeneric
SiemensSimatic HMIGeneric
SiemensSimatic NETGeneric
SiemensSimatic S7Generic
SoftPLCGenericGeneric
SomfyGenericGeneric
SpiderControlGenericGeneric
StulzGenericGeneric
THUSGenericGeneric
TrendIQ3xciteGeneric
TridiumGenericGeneric
WagoGenericGeneric
Wind RiverGenericGeneric
Note The Taxonomy page only shows the Vendors, Products and Versions contained in this specific release.
Country Vendor Product Version Method Dork Results
CHGenericGenericGenericShodan"Server: VTS" -IIS -Apache -nginx 401 -500 -Boa -Sitewatch -Apple -httpd -cpsrvd -Ubicom -DCS-66200
ITGenericGenericGenericShodan"Server: VTS" -IIS -Apache -nginx 401 -500 -Boa -Sitewatch -Apple -httpd -cpsrvd -Ubicom -DCS-66200
WORLDGenericGenericGenericShodan"Server: VTS" -IIS -Apache -nginx 401 -500 -Boa -Sitewatch -Apple -httpd -cpsrvd -Ubicom -DCS-6620180
CHGenericGenericGenericShodan--All--884607
ITGenericGenericGenericShodan--All--6299498
WORLDGenericGenericGenericShodan--All--0
ITAdcon TelemetryA850 Telemetry Gateway GenericShodanA850 Telemetry Gateway1
WORLDAdcon TelemetryA850 Telemetry Gateway GenericShodanA850 Telemetry Gateway29
CHAdcon TelemetryA850 Telemetry Gateway GenericShodanA850 Telemetry Gateway0
WORLDABBRTU500RTU560ShodanABB RTU56018
CHABBRTU500RTU560ShodanABB RTU5600
ITABBRTU500RTU560ShodanABB RTU5603
WORLDABBGenericGenericShodanABB Webmodule3
CHABBGenericGenericShodanABB Webmodule0
ITABBGenericGenericShodanABB Webmodule0
CHACKPGenericGenericShodanAKCP Embedded Web Server17
ITACKPGenericGenericShodanAKCP Embedded Web Server46
WORLDACKPGenericGenericShodanAKCP Embedded Web Server865
ITAllen-BradleyGenericGenericShodanAllen-Bradley0
CHAllen-BradleyGenericGenericShodanAllen-Bradley0
WORLDAllen-BradleyGenericGenericShodanAllen-Bradley74
WORLDBroadWebGenericGenericShodanBroadWeb359
ITBroadWebGenericGenericShodanBroadWeb0
CHBroadWebGenericGenericShodanBroadWeb0
WORLDGeneral ElectricCimplicityGenericShodanCIMPLICITY-HttpSvr219
CHGeneral ElectricCimplicityGenericShodanCIMPLICITY-HttpSvr1
ITGeneral ElectricCimplicityGenericShodanCIMPLICITY-HttpSvr27
WORLDCimetricsEplus - B/IP to B/WS Gateway FirewallGenericShodanCimetrics Eplus Web Server16
ITCimetricsEplus - B/IP to B/WS Gateway FirewallGenericShodanCimetrics Eplus Web Server0
CHCimetricsEplus - B/IP to B/WS Gateway FirewallGenericShodanCimetrics Eplus Web Server0
CHSchneider ElectricCitectSCADAGenericShodanCitectSCADA0
WORLDSchneider ElectricCitectSCADAGenericShodanCitectSCADA5
ITSchneider ElectricCitectSCADAGenericShodanCitectSCADA1
CHSchneider ElectricGenericGenericShodanClearSCADA0
WORLDSchneider ElectricGenericGenericShodanClearSCADA145
ITSchneider ElectricGenericGenericShodanClearSCADA4
CHDelta ControlsenteliTOUCHGenericShodanDELTA enteliTOUCH0
ITDelta ControlsenteliTOUCHGenericShodanDELTA enteliTOUCH4
WORLDDelta ControlsenteliTOUCHGenericShodanDELTA enteliTOUCH122
ITElectro Industries GaugeTechGenericGenericShodanEIG Embedded Web Server0
WORLDElectro Industries GaugeTechGenericGenericShodanEIG Embedded Web Server187
CHElectro Industries GaugeTechGenericGenericShodanEIG Embedded Web Server0
CHElectro Industries GaugeTechGenericGenericShodanEIG Embedded Web Server0
WORLDElectro Industries GaugeTechGenericGenericShodanEIG Embedded Web Server187
ITElectro Industries GaugeTechGenericGenericShodanEIG Embedded Web Server0
WORLDElster EnergyICTGenericGenericShodanEnergyICT2603
ITElster EnergyICTGenericGenericShodanEnergyICT0
CHElster EnergyICTGenericGenericShodanEnergyICT0
WORLDElster EnergyICTRTUGenericShodanEnergyICT RTU2595
ITElster EnergyICTRTUGenericShodanEnergyICT RTU0
CHElster EnergyICTRTUGenericShodanEnergyICT RTU0
ITGenericGenericGenericShodanGoAhead-Webs InitialPage.asp0
CHGenericGenericGenericShodanGoAhead-Webs InitialPage.asp0
WORLDGenericGenericGenericShodanGoAhead-Webs InitialPage.asp82
WORLDSchneider ElectricPowerLogic EGXEGX100MGShodanHMI, XP27720
ITSchneider ElectricPowerLogic EGXEGX100MGShodanHMI, XP2770
CHSchneider ElectricPowerLogic EGXEGX100MGShodanHMI, XP2770
WORLDHMSEtherNet/IP / Modbus-TCP Interface GenericShodanHMS AnyBus-S WebServer137
WORLDHMSEtherNet/IP / Modbus-TCP Interface GenericShodanHMS AnyBus-S WebServer137
ITHMSEtherNet/IP / Modbus-TCP Interface GenericShodanHMS AnyBus-S WebServer1
CHHMSEtherNet/IP / Modbus-TCP Interface GenericShodanHMS AnyBus-S WebServer0
ITHMSEtherNet/IP / Modbus-TCP Interface GenericShodanHMS AnyBus-S WebServer1
CHHMSEtherNet/IP / Modbus-TCP Interface GenericShodanHMS AnyBus-S WebServer0
WORLDBeck IPCIPC@CHIPGenericShodanIPC@CHIP25405
CHBeck IPCIPC@CHIPGenericShodanIPC@CHIP283
ITBeck IPCIPC@CHIPGenericShodanIPC@CHIP4364
CHClorius ControlsGenericGenericShodanISC SCADA Service HTTPserv:000010
WORLDClorius ControlsGenericGenericShodanISC SCADA Service HTTPserv:0000112
ITClorius ControlsGenericGenericShodanISC SCADA Service HTTPserv:000010
WORLDSchneider ElectricModiconM340ShodanModicon M34092
WORLDGenericGenericGenericShodanJetty 3.1.8 (Windows 2000 5.0 x86)384
ITGenericGenericGenericShodanJetty 3.1.8 (Windows 2000 5.0 x86)14
CHGenericGenericGenericShodanJetty 3.1.8 (Windows 2000 5.0 x86)0
WORLDGenericGenericGenericShodanModbus Bridge80
ITGenericGenericGenericShodanModbus Bridge0
CHGenericGenericGenericShodanModbus Bridge0
WORLDGenericGenericGenericShodanModbusGW73
ITGenericGenericGenericShodanModbusGW19
CHGenericGenericGenericShodanModbusGW0
WORLDRockwell AutomationMicrologixGenericShodanMicrologix6
ITRockwell AutomationMicrologixGenericShodanMicrologix0
CHRockwell AutomationMicrologixGenericShodanMicrologix0
WORLDGenericGenericGenericShodanNET ARM Web Server/1.00453
ITGenericGenericGenericShodanNET ARM Web Server/1.001
CHGenericGenericGenericShodanNET ARM Web Server/1.000
ITSchneider ElectricModiconM340ShodanModicon M3401
CHSchneider ElectricModiconM340ShodanModicon M3401
WORLDMoxaGenericGenericShodanMoxaHttp10748
ITMoxaGenericGenericShodanMoxaHttp824
CHMoxaGenericGenericShodanMoxaHttp83
WORLDSchneider ElectricModiconM340ShodanModicon M340 CPU42
ITSchneider ElectricModiconM340ShodanModicon M340 CPU0
CHSchneider ElectricModiconM340ShodanModicon M340 CPU1
ITTridiumGenericGenericShodanNiagara Web Server968
CHTridiumGenericGenericShodanNiagara Web Server182
WORLDGenericGenericGenericShodanPLC7215
ITGenericGenericGenericShodanPLC58
CHGenericGenericGenericShodanPLC60
WORLDSiemensSimatic S7GenericShodanPortal0000.htm174
ITSiemensSimatic S7GenericShodanPortal0000.htm13
CHSiemensSimatic S7GenericShodanPortal0000.htm16
WORLDSiemensSimatic S7GenericShodanPortal0000174
ITSiemensSimatic S7GenericShodanPortal000013
CHSiemensSimatic S7GenericShodanPortal000016
WORLDTridiumGenericGenericShodanNiagara Web Server31109
WORLDNovatechGenericGenericShodanNovaTech HTTPD0
ITNovatechGenericGenericShodanNovaTech HTTPD0
CHNovatechGenericGenericShodanNovaTech HTTPD0
WORLDSchneider ElectricGenericGenericShodanPower Measurement Ltd867
ITSchneider ElectricGenericGenericShodanPower Measurement Ltd0
WORLDSchneider ElectricPowerLogic IONION8650ShodanPower Measurement Ltd ION865020
CHSchneider ElectricGenericGenericShodanPower Measurement Ltd0
ITSchneider ElectricPowerLogic IONION8650ShodanPower Measurement Ltd ION86500
CHSchneider ElectricPowerLogic IONION8650ShodanPower Measurement Ltd ION86500
WORLDSchneider ElectricPowerLogic PMPM800ShodanPowerLogic PM80085
ITSchneider ElectricPowerLogic PMPM800ShodanPowerLogic PM8000
CHSchneider ElectricPowerLogic PMPM800ShodanPowerLogic PM8000
WORLDGenericGenericGenericShodanPowerlink2587
ITGenericGenericGenericShodanPowerlink19
CHGenericGenericGenericShodanPowerlink45
WORLDGeneral ElectricProficyGenericShodanProficyPortal3
CHGeneral ElectricProficyGenericShodanProficyPortal0
ITGeneral ElectricProficyGenericShodanProficyPortal0
CHRTS ServicesGenericGenericShodanRTS SCADA Server0
ITRTS ServicesGenericGenericShodanRTS SCADA Server0
WORLDRTS ServicesGenericGenericShodanRTS SCADA Server24
CHRelianceReliance 4 SCADA/HMI systemGenericShodanReliance 4 Control Server0
ITRelianceReliance 4 SCADA/HMI systemGenericShodanReliance 4 Control Server0
WORLDRelianceReliance 4 SCADA/HMI systemGenericShodanReliance 4 Control Server4
WORLDRockwell AutomationGenericGenericShodanRockwell Automation195
CHRockwell AutomationGenericGenericShodanRockwell Automation1
CHSchneider ElectricPowerLogic PMPM820SDShodanS7-2000
ITRockwell AutomationGenericGenericShodanRockwell Automation5
WORLDSchneider ElectricPowerLogic PMPM820SDShodanS7-2003
ITSchneider ElectricPowerLogic PMPM820SDShodanS7-2000
CHSchneider ElectricPowerLogic PMPM820SDShodanS7-3003
WORLDSchneider ElectricPowerLogic PMPM820SDShodanS7-30028
ITSchneider ElectricPowerLogic PMPM820SDShodanS7-3001
ITSAPNetWeaver Application ServerGenericShodanSAP NetWeaver Application Server54
WORLDSAPNetWeaver Application ServerGenericShodanSAP NetWeaver Application Server2141
CHSAPNetWeaver Application ServerGenericShodanSAP NetWeaver Application Server54
WORLDGenericGenericGenericShodanSCADA502
ITGenericGenericGenericShodanSCADA21
CHGenericGenericGenericShodanSCADA1
WORLDSiemensSimatic HMIGenericShodanSIMATIC HMI56
ITSiemensSimatic HMIGenericShodanSIMATIC HMI3
CHSiemensSimatic HMIGenericShodanSIMATIC HMI0
CHSiemensSimatic NETGenericShodanSIMATIC NET15
WORLDSiemensSimatic NETGenericShodanSIMATIC NET130
ITSiemensSimatic NETGenericShodanSIMATIC NET8
WORLDGenericGenericGenericShodanSLC562
CHGenericGenericGenericShodanSLC50
ITGenericGenericGenericShodanSLC50
WORLDSiemensScalance SGenericShodanScalance S4
ITSiemensScalance SGenericShodanScalance S0
CHSiemensScalance SGenericShodanScalance S0
CHSiemensScalance WGenericShodanScalance W0
WORLDSiemensScalance WGenericShodanScalance W6
ITSiemensScalance WGenericShodanScalance W4
WORLDSiemensScalance XGenericShodanScalance X23
ITSiemensScalance XGenericShodanScalance X0
WORLDSchleifenbauerSPbus gatewayGenericShodanSchleifenbauer SPbus gateway16
ITSchleifenbauerSPbus gatewayGenericShodanSchleifenbauer SPbus gateway0
CHSchleifenbauerSPbus gatewayGenericShodanSchleifenbauer SPbus gateway1
CHSiemensScalance XGenericShodanScalance X0
WORLDSchneider ElectricPowerLogic ECCECC21ShodanSchneider Electric ECC211
ITSchneider ElectricPowerLogic ECCECC21ShodanSchneider Electric ECC210
CHSchneider ElectricPowerLogic ECCECC21ShodanSchneider Electric ECC210
WORLDSchneider ElectricPowerLogic EGXEGX100MGShodanSchneider Electric EGX100MG2
ITSchneider ElectricPowerLogic EGXEGX100MGShodanSchneider Electric EGX100MG1
CHSchneider ElectricPowerLogic EGXEGX100MGShodanSchneider Electric EGX100MG0
WORLDSchneider ElectricPowerLogic PMPM820SDShodanSchneider Electric PM820SD1
ITSchneider ElectricPowerLogic PMPM820SDShodanSchneider Electric PM820SD0
CHSchneider ElectricPowerLogic PMPM820SDShodanSchneider Electric PM820SD0
CHSchneider ElectricPowerLogic PMPM870SDShodanSchneider Electric PM870SD0
ITSchneider ElectricPowerLogic PMPM870SDShodanSchneider Electric PM870SD0
WORLDSchneider ElectricPowerLogic PMPM870SDShodanSchneider Electric PM870SD2
WORLDSchneider ElectricGenericGenericShodanSchneider-WEB483
ITSchneider ElectricGenericGenericShodanSchneider-WEB51
CHSchneider ElectricGenericGenericShodanSchneider-WEB10
WORLDAllen-BradleyGenericGenericShodanSeries C Revision63
ITAllen-BradleyGenericGenericShodanSeries C Revision0
CHAllen-BradleyGenericGenericShodanSeries C Revision0
WORLDSiemensGenericGenericShodanSiemens137194
CHSiemensGenericGenericShodanSiemens493
ITSiemensGenericGenericShodanSiemens597
CHSiemensSimatic HMIGenericShodanSimatic19
WORLDSiemensSimatic HMIGenericShodanSimatic329
ITSiemensSimatic HMIGenericShodanSimatic19
ITSiemensSimatic S7GenericShodanSimatic S75
CHSiemensSimatic S7GenericShodanSimatic S73
WORLDSiemensSimatic HMIGenericShodanSimatic -S7 HMI56
ITSiemensSimatic HMIGenericShodanSimatic -S7 HMI3
CHSiemensSimatic HMIGenericShodanSimatic -S7 HMI0
WORLDSiemensSimatic S7GenericShodanSimatic S7112
WORLDSiemensSimatic NETGenericShodanSimatic net130
ITSiemensSimatic NETGenericShodanSimatic net8
CHSiemensSimatic NETGenericShodanSimatic net15
CHSoftPLCGenericGenericShodanSoftPLC0
WORLDSpiderControlGenericGenericShodanSpiderControl1004
ITSpiderControlGenericGenericShodanSpiderControl425
CHSpiderControlGenericGenericShodanSpiderControl16
WORLDSoftPLCGenericGenericShodanSoftPLC951
ITSoftPLCGenericGenericShodanSoftPLC1
WORLDStulzGenericGenericShodanStulz GmbH Klimatechnik41
CHStulzGenericGenericShodanStulz GmbH Klimatechnik0
ITStulzGenericGenericShodanStulz GmbH Klimatechnik2
CHSchneider ElectricTac XENTA 913GenericShodanTAC/Xenta55
WORLDSchneider ElectricTac XENTA 913GenericShodanTAC/Xenta9445
ITSchneider ElectricTac XENTA 913GenericShodanTAC/Xenta111
WORLDSchneider ElectricModiconGenericShodanTELEMECANIQUE BMX92
CHSchneider ElectricModiconGenericShodanTELEMECANIQUE BMX1
ITSchneider ElectricModiconGenericShodanTELEMECANIQUE BMX1
WORLDTHUSGenericGenericShodanTHUS plc FTP server4339
ITTHUSGenericGenericShodanTHUS plc FTP server0
CHTHUSGenericGenericShodanTHUS plc FTP server0
CHSchneider ElectricTac XENTA 913GenericShodanTac XENTA 9130
ITSchneider ElectricTac XENTA 913GenericShodanTac XENTA 9131
WORLDSchneider ElectricTac XENTA 913GenericShodanTac XENTA 913116
CHWind RiverGenericGenericShodanVxWorks180
ITWind RiverGenericGenericShodanVxWorks6790
WORLDWind RiverGenericGenericShodanVxWorks146503
WORLDCodesysWebVisuGenericShodanWebvisu635
WORLDWagoGenericGenericShodanWAGO315
ITWagoGenericGenericShodanWAGO37
CHWagoGenericGenericShodanWAGO155
ITCodesysWebVisuGenericShodanWebvisu48
CHCodesysWebVisuGenericShodanWebvisu635
WORLDSiemensSimatic HMIGenericShodanWelcome to the Windows CE Telnet Service on HMI_Panel51
ITSiemensSimatic HMIGenericShodanWelcome to the Windows CE Telnet Service on HMI_Panel3
WORLDWind RiverGenericGenericShodanWindRiver-WebServer18918
ITWind RiverGenericGenericShodanWindRiver-WebServer104
CHWind RiverGenericGenericShodanWindRiver-WebServer25
CHSiemensSimatic HMIGenericShodanWelcome to the Windows CE Telnet Service on HMI_Panel0
ITNRG SystemsWindCubeGenericShodanWindWeb1525
CHNRG SystemsWindCubeGenericShodanWindWeb157
WORLDNRG SystemsWindCubeGenericShodanWindWeb57157
ITRabbitGenericGenericShodanZ-World Rabbit612
WORLDRabbitGenericGenericShodanZ-World Rabbit9525
CHRabbitGenericGenericShodanZ-World Rabbit7
WORLDAdcon TelemetryaddUPI-OPC ServerGenericShodanaddUPI Server891
ITAdcon TelemetryaddUPI-OPC ServerGenericShodanaddUPI Server6
CHAdcon TelemetryaddUPI-OPC ServerGenericShodanaddUPI Server0
WORLDElster EnergyICTeiPortalGenericShodaneiPortal1
ITElster EnergyICTeiPortalGenericShodaneiPortal0
CHElster EnergyICTeiPortalGenericShodaneiPortal0
WORLDEcheloni.LON 600GenericShodani.LON5862
ITEcheloni.LON 600GenericShodani.LON81
CHEcheloni.LON 600GenericShodani.LON43
WORLDMoxaioLogikGenericShodanioLogik Web Server168
CHMoxaioLogikGenericShodanioLogik Web Server0
ITMoxaioLogikGenericShodanioLogik Web Server0
ITTridiumGenericGenericShodanniagara_audit27
CHTridiumGenericGenericShodanniagara_audit107
WORLDTridiumGenericGenericShodanniagara_audit14004
ITTridiumGenericGenericShodanniagara_audit -login0
WORLDTridiumGenericGenericShodanniagara_audit -login827
CHTridiumGenericGenericShodanniagara_audit -login6
ITGenericGenericGenericShodanopenerp server:CherryPy47
CHGenericGenericGenericShodanopenerp server:CherryPy21
WORLDGenericGenericGenericShodanopenerp server:CherryPy1196
WORLDSchneider ElectricPowerLogic IONGenericShodanport:23 "Meter ION"81
ITSchneider ElectricPowerLogic IONGenericShodanport:23 "Meter ION"0
CHSchneider ElectricPowerLogic IONGenericShodanport:23 "Meter ION"0
CHTrendIQ3xciteGenericShodanserver:iq38
ITTrendIQ3xciteGenericShodanserver:iq384
WORLDTrendIQ3xciteGenericShodanserver:iq33838
WORLDFujitsuServerViewGenericShodanserverview279
ITFujitsuServerViewGenericShodanserverview7
CHFujitsuServerViewGenericShodanserverview3
WORLDSchneider ElectricGenericGenericShodantitle:PowerLogic392
ITSchneider ElectricGenericGenericShodantitle:PowerLogic0
CHSchneider ElectricGenericGenericShodantitle:PowerLogic0
WORLDSomfyGenericGenericShodantitle:Somfy3070
ITSomfyGenericGenericShodantitle:Somfy0
CHSomfyGenericGenericShodantitle:Somfy3
ITAdcon TelemetryGenericGenericShodantitle:adcon0
WORLDAdcon TelemetryGenericGenericShodantitle:adcon410
CHAdcon TelemetryGenericGenericShodantitle:adcon0
WORLDRabbitGenericGenericShodantitle:phasefale Z-World Rabbit4
ITRabbitGenericGenericShodantitle:phasefale Z-World Rabbit0
CHRabbitGenericGenericShodantitle:phasefale Z-World Rabbit0
WORLDGenericGenericGenericShodanwebSCADA-Modbus5
ITGenericGenericGenericShodanwebSCADA-Modbus0
CHGenericGenericGenericShodanwebSCADA-Modbus0