Loading the path…

Plant PLC

ENG-WS-04 opens SMB into cell 3, where the HMI still has the vendor default.

Open path

Fix that breaks this chain

Cut the plant route and replace the HMI default

One segmentation change plus a password rotation stops the path from the engineering workstation to the cell.

SMB session to HMI-CELL-3.

from: ENG-WS-04 (10.20.4.22)
to: HMI-CELL-3 (10.20.40.3) SMB
session: established
Claroty: no block, no alert
No command was run on the HMI.

Fix. Drop the route from the engineering VLAN into the cell network.

3. Default HMI password
hmiadmin is still the vendor default.
```
host: HMI-CELL-3
account: hmiadmin
password: vendor default [redacted]
banner confirmed the account
session was not opened
```
Fix. Replace the default and keep the HMI off the engineering VLAN.
Open weakness
4. hmiadmin
Operator on cell 3.
5. Plant PLC
The HMI writes setpoints to the cell controller. No command was sent.

Found on PT-1802.

Loading the path…