Siemens S7 Exposure: 161,907 Hosts on Port 102 vs. 173 on Port 173

Understanding Disparate Siemens S7 Scan Results

On September 20, 2026, two distinct queries against the ZoomEye AI cyberspace search service, executed mere minutes apart, yielded drastically different counts for Siemens S7 devices. One query, targeting port="102", returned 161,907 hosts. The other, targeting port="173", returned a mere 173. Both queries aimed to identify Siemens S7 devices, yet the three-orders-of-magnitude difference in results highlights a critical nuance in internet-wide scanning and exposure assessment. Understanding this discrepancy is not academic; it's the difference between a defensible security posture and a number that will not withstand scrutiny.

The Nuance of Port Scanning

The core of the issue lies in how different ports are used by industrial control systems (ICS) and how these ports are interpreted by scanning tools. Port 102 is a standard port for the TCP/IP Industrial Control Systems protocol, often used by Siemens S7 devices for communication. It's a general-purpose port for ICS communications, and thus, a broad scan for it will capture a wide array of devices that might be using it for various functions, not exclusively S7 communication.

Conversely, port 173 is specifically associated with the Siemens S7 communication protocol. When a scanner identifies a Siemens S7 device responding on port 173, it's a much stronger signal that the device is indeed an S7 PLC. However, not all Siemens S7 devices may expose functionality on port 173, or conversely, other devices might use port 173 for non-S7 related functions, though this is less common. The difference in counts suggests that while many devices are accessible via the general ICS port 102, a much smaller subset are specifically broadcasting an S7 fingerprint on their dedicated port 173.

Interpreting the Data

The query port="102", while yielding a large number, is less precise. It indicates that 161,907 hosts are listening on port 102, a port commonly used by ICS. However, it doesn't definitively confirm that all these devices are Siemens S7 PLCs. They could be other ICS devices, or even non-ICS devices that happen to be using port 102. The additional filter device="plc" narrows this down to 95,749, and app="Siemens S7" further refines it to an even smaller number, which was not fully provided in the source but is implied to be much lower than 161,907.

The query port="173", on the other hand, is highly specific. A response on port 173 is a strong indicator of a Siemens S7 device. The count of 173 suggests a much smaller, but likely more accurate, footprint of Siemens S7 devices actively advertising their presence on this specific port. This could be due to network segmentation, specific configurations, or that only certain S7 functionalities are exposed externally.

The Importance of Context in Exposure Assessment

This disparity is a crucial lesson for anyone performing cybersecurity assessments, particularly in Operational Technology (OT) environments. Relying on a single scan metric can lead to significant under or overestimations of exposure. For instance, a security team might see 161,907 devices listening on port 102 and panic, initiating a broad, potentially disruptive, remediation effort. Alternatively, they might dismiss the exposure based on a low count from a less specific scan, failing to identify critical vulnerabilities.

A more robust approach involves triangulating data from multiple sources and scan types. This includes not only port scans but also service banner grabbing, application-layer fingerprinting, and even passive reconnaissance techniques. For Siemens S7 devices, correlating results from port 102 scans with specific S7 fingerprinting on port 173, or other known S7 ports and protocols, provides a much clearer picture of the actual attack surface. It’s like trying to identify a specific person in a crowd: looking for anyone wearing a blue shirt (port 102) will give you a large group, but looking for someone wearing a specific, unique band t-shirt (port 173 with S7 fingerprint) narrows it down precisely.

What is the Real Exposure?

The immediate question arising from these differing numbers is: what is the true number of Siemens S7 devices exposed to the internet? The data suggests that the 173 devices identified on port 173 represent a highly specific and likely vulnerable subset. However, the 161,907 devices on port 102 cannot be entirely dismissed. Some portion of these may indeed be Siemens S7 devices that are not configured to respond on port 173, or whose S7 fingerprint is not readily detectable by the specific query used. The challenge for security professionals is to develop methodologies that can accurately distinguish between these groups and assess the risk associated with each.

This situation underscores the need for continuous, multi-faceted monitoring of internet-facing industrial control systems. The variability in scan results serves as a stark reminder that cyberspace is dynamic and that a single snapshot, particularly one based on a generalized port scan, can be misleading. Organizations must invest in specialized tools and expertise to accurately inventory and secure their OT assets, ensuring that remediation efforts are targeted and effective.