Vendor proprietary
PCOM
The proprietary protocol used by Unitronics all-in-one PLC+HMI controllers (Vision, Samba and UniStream families). It exposes operand and data-table access, and on many deployments sits directly on the internet on 20256/TCP — the condition behind the 2023 targeting of US water utilities.
How it works
A client connects to 20256/TCP and exchanges ASCII or binary PCOM frames addressing operands (MB, MI, ML, SB, SI) and data tables. VisiLogic and UniLogic use the same channel for program download; the embedded VNC server on 5900/TCP exposes the HMI screen separately.
Communication patternClient connects to 20256/TCP → reads/writes operands → optionally downloads a program.
Fact sheet
Why should I care?
Understanding PCOM is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Read / write operands and data tables
- Read controller name and version
- Program download
- Run / stop control
Security concerns
- Devices are frequently internet-exposed by cellular routers or port forwards at unstaffed sites
- Default device password (historically 1111) is widely known and often unchanged
- The HMI screen itself can be defaced without touching the process logic — an obvious psychological impact
- Embedded VNC on 5900/TCP is a second, separately reachable path into the same device
- Small utilities running these units rarely have any OT monitoring at all
What normal looks like
- Local SCADA or cellular gateway polling on a fixed cadence
- Programming only from a VisiLogic/UniLogic host during commissioning
What deserves attention
- Any inbound connection to 20256/TCP or 5900/TCP from outside the site
- Successful authentication from a foreign source address
- Operand writes or a program download with no matching work order
- HMI screen content changing without an engineering change
Hunting ideas
- default-credentials-field-devices
- unexpected-internet-connectivity
- unauthorized-plc-programming
Defensive controls
- Remove the controller from the public internet — no port forward, no default-route cellular exposure
- Change the device password from the default and set a unique value per site
- Place remote sites behind a VPN or a broker with multi-factor authentication
- Change the default PCOM port where the deployment allows, as a supplement to — not a substitute for — removing exposure
- Retain a documented manual operating mode for each affected site
Related ATT&CK for ICS techniques
Seen in incidents
- unitronics-2023