ICS / OTTCP 502 Cleartext by default
Port 502: Modbus
Modbus TCP
A simple industrial protocol for reading and writing PLC coils and registers. It has no authentication or encryption.
How attackers abuse it
- Anyone who can reach the PLC can read values or write commands that change a physical process.
How to defend it
- Segment OT networks (zones and conduits); never expose 502 to the internet.
- Allow-list which hosts may write; monitor function codes with an OT-aware IDS.
Exam tip
Legacy ICS protocols rely on network segmentation, not built-in security.