NSA, CISA, FBI, DOE, EPA warn AI-generated scripts target Siemens PLCs

A joint advisory AA26-231A says attackers use AI-generated scripts to target Siemens S7-200/300/400/1200/1500 PLCs via open port 102. No new vulnerabilities are involved, only weak authentication and direct internet exposure.

• Advisory AA26-231A signed by NSA, CISA, FBI, DOE and EPA
• Attacks use port 102 with snap7 and python-snap7 libraries
• Siemens confirmed no new vulnerabilities, only configurations
• Indicator of compromise is snap7.dll outside approved systems