Modbus exposure check: is an industrial device exposed on port 502?
Will probe whether a host responds on Modbus/TCP port 502, without reading or writing any register, and flag the exposure as higher severity when it looks industrial alongside other OT-relevant ports, since Modbus/TCP has no built-in authentication. Coming with the AdminKit Check API.
Whether a host responds on Modbus/TCP port 502 from the internet — never reading or writing registers.
- Connection probe only, nothing read or written
- A severity note when the exposure looks industrial
- Ships with the AdminKit Check API, built on the same checks/modbus library as the OT access product
Next step
Also see MQTT exposure, or check other commonly exposed ports.
How it works and limits
Modbus/TCP is the dominant protocol connecting factory-floor PLCs, sensors and controllers. It predates the internet threat model entirely and has no authentication built in — anything that can reach port 502 can read or write registers controlling real physical equipment.
What it will check
- Whether a host responds on Modbus/TCP port 502 at all, from the public internet.
- Nothing beyond the connection itself: no register is read or written.
- A severity note when the exposure looks industrial (paired with the port-check tool’s other OT-relevant ports).
Why this is not live yet
It ships with the AdminKit Check API, built on the same checks/modbus library used elsewhere in AdminKit’s OT access
product line, so the same tested logic is reused rather than duplicated in a public-facing function.
Check manually today
nc -vz -w 3 <host> 502A successful connection means the port is reachable from wherever you ran this command — treat any factory or OT device that answers here as needing to be moved behind a firewall or VPN, not reachable directly from the internet. Only test equipment you are authorized to test.
Frequently asked questions
Why is this tool not live yet?
It ships with the AdminKit Check API (plan milestone M5), using the checks/modbus library built in parallel (plan milestone M3).
Why does Modbus have no authentication?
Modbus/TCP was designed for isolated factory networks in the 1990s and has no built-in authentication — exposing it to the internet lets anyone read or write registers.