Standard
Siemens' proprietary protocol for communicating with S7-series PLCs, used to read/write memory, configuration data, and ladder logic over Industrial Ethernet.
Port counts for 102, 502 and 44818 in a 22 September 2026 ZoomEye snapshot cannot be summed into one exposure figure, a dev.to analysis says. The totals are index entries for protocols with different vendor bases and risk profiles, so none of them is a count of vulnerable devices.
Reality
A hand-built client walked TPKT, COTP and S7comm against a Snap7 server on port 102, negotiated a 480-byte PDU and pulled 16 bytes out of DB3 with function code 0x04. The layers below that byte are the same for a write.
Reality
Joint advisory AA26-231A describes threat actors feeding internet-scan results into AI tools that emit working python-snap7 clients against Siemens S7 controllers. Siemens says the weakness is configuration, not a new vulnerability.
Reality
Five US agencies told PLC owners that scanners are finding exposed Siemens S7 controllers. ZoomEye puts that surface at 173 assets by product fingerprint, or 161,764 by open port.
Reality
A Siemens-specific follow-up to the July PLC warning describes internet-wide discovery paired with AI-generated Python tooling that reads and writes ladder logic.
Reality