Legacy OT systems vulnerable to denial-of-service attacks

Operational technology devices that control factories, power substations and remote sites can be disabled by denial-of-service attacks because many lack modern memory protections and input checks. Security researchers and industry officials say such failures can stop actuators, freeze robots and halt production lines.

Tod Beardsley, vice president of security research at runZero and a former vulnerability response chief at CISA, points to long-standing design choices as the cause. Many OT controllers and programmable logic controllers were built for trusted local networks, run older compiled code on limited hardware and do not include defenses like address space layout randomization or data execution protection. Small malformed packets or sustained streams of invalid traffic can overwhelm these devices and cause them to crash or enter safe states.

Denial-of-service effects in OT differ from typical IT outages because operators often do not have quick failover or spare equipment nearby. Some embedded controllers cannot be reprogrammed in the field; others are located at distant or regulated sites where unscheduled updates are restricted. In those cases the visible remedies are physical hardware replacement or planned, coordinated updates that require regulatory approval and operational downtime.

The process for disclosing OT vulnerabilities presents trade-offs. Public discussion can trigger rapid attention from government agencies and create risk if exploit code is published. Conversely, withholding a serious zero-day can leave operators exposed as corporate networks and industrial control systems connect. Beardsley urged researchers to report newly discovered OT flaws through formal channels and recommended the U.S. Cybersecurity and Infrastructure Security Agency reporting portal at cisa.gov/report. He added, “It’s only a matter of time when your easy finding becomes someone else’s critical infrastructure weapon.” Vendors and regional CERTs have increasingly worked with CISA to handle sensitive disclosures.

Because many devices cannot be patched quickly, operators commonly rely on network segmentation, strict access controls and monitored connections to limit exposure. When vendors can supply updates, deploying them can require planned outages, so compensating controls often remain the immediate mitigation while fixes are scheduled and tested.