ZoomEye counts 161,764 port-102 services behind Siemens PLC advisory AA26-231A

Joint Cybersecurity Advisory AA26-231A warned in August 2026 that threat actors were using internet-wide scanning to find exposed Siemens S7 programmable logic controllers, but it never said how large that exposed population might be. A measurement published on dev.to now attaches numbers: on 16 September 2026, the search engine ZoomEye had indexed 161,764 assets with TCP port 102 reachable — the port tied to the S7comm protocol named in the advisory — alongside much smaller figures for tighter, product-specific queries.

What the advisory described

According to the dev.to write-up, the advisory was issued on 19 August 2026 by the NSA, CISA, the FBI, the Department of Energy and the Environmental Protection Agency. It describes actors who locate internet-exposed or weakly protected PLCs running outdated software, then use AI-generated scripts — built on the open-source snap7.dll and python-snap7 libraries and disguised as ordinary monitoring tools — to read and write PLC memory, configuration data and ladder logic over S7comm, usually on TCP port 102.

The S7-200, S7-300, S7-400, S7-1200 and S7-1500 families are named, including F-series safety controllers. Notably, the advisory lists no CVE identifiers and no indicators of compromise; it points at known weaknesses and misconfigurations in general rather than one shared flaw.

Sizing the surface, query by query

The dev.to author queried ZoomEye at four levels of specificity on 16 September 2026, and the results measure different things:

• 173 assets matched the narrowest fingerprint, app="Siemens S7".
• 10,160 matched the broader app="Siemens SIMATIC" fingerprint, which spans a wider product family.
• 161,764 had port 102 reachable.
• 95,395 were classified as PLCs across all vendors, not just Siemens.

Presenting any one figure without its scope would be misleading, the article argues. Port 102 is associated with S7comm, but something answering on that port could be another service or another vendor's equipment, and reachability alone says nothing about whether a device is actually vulnerable.

Why the numbers diverge

The distance between 173 and 161,764 is not a contradiction, according to the analysis. A product fingerprint requires the scanner to recognise specific device characteristics; a port query only requires that something respond. The first describes a product population, the second a protocol surface.

The advisory's own framing supports the wider reading: it notes that the targeting extends beyond Siemens devices and that all PLC operators should apply mitigations, a stance consistent with the 95,395 all-vendor PLC classification.

Exposure is the operative risk

The advisory's central claim is that actors find targets through internet scanning, which makes external exposure the key risk factor and exposure reduction the primary mitigation — a controller that is unreachable from the internet cannot be found by an internet scanner. Consequences of unauthorised access listed in the advisory include disruption of industrial processes, safety incidents, equipment damage, data compromise, cascading effects and compliance violations.

Siemens has firmware updates available through ProductCRT under advisory SSB-104599, while simultaneously stating that AA26-231A does not describe a new vulnerability in the S7 series. The dev.to article treats the two positions as compatible: the advisory covers exploitation of known weaknesses and misconfigurations, so the recommended response is layered — shrink exposure, patch firmware, harden authentication and watch for anomalous S7comm activity.

Using the data responsibly

For asset owners, the article suggests treating external scan data as a cross-check rather than a primary source. Querying an organisation's own address range with the narrow Siemens S7 fingerprint answers how many of its controllers are reachable; a port-102 query over the same range verifies that nothing unexpected is answering. Either way, scans should stay inside address space the organisation actually controls.

Why it matters

The nearly thousandfold spread between the tightest and loosest query is a lesson in measurement discipline: the number that matters depends entirely on the question being asked. None of the counts are tallies of vulnerable or compromised devices — they are what ZoomEye indexed at collection time. Even so, they give the first public sense of scale behind AA26-231A, and they underline the advisory's core point: with open-source S7comm libraries and cheap scanning, exposed controllers are findable, so the surest defence is not being findable at all.