Modbus.TCP.Report.Server.Info

description-logoDescription

This indicates that an attacker may have attempted to get information from a PLC or other Modbus server by issuing the "Report Slave ID" request.
Modbus TCP is a protocol often found in SCADA networks where it is used for process control. A "Report Slave" request will reveal device specific information that could be used to mount further attacks.

affected-products-logoAffected Products

PLCs and Modbus TCP servers.

Impact logoImpact

Information disclosure.

recomended-action-logoRecommended Actions

Investigate the source of the traffic to determine if it is malicious in nature.

Telemetry logoTelemetry

Coverage

IPS (Regular DB)
IPS (Extended DB)