Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To find cellular modems connected to a water or wastewater system’s operational technology (OT), combine an inventory review, physical inspections of remote sites, and logical network surveys. A scan alone cannot prove that every connection has been found: a modem installed by a utility, vendor, or system integrator may be missing from records and routine attack-surface scans. Once found, determine whether the route is operationally necessary; remove unnecessary internet connections, and document and control the ones that must remain.
Why a cellular modem can be an invisible route into OT
Cellular modems can connect remote tanks, lift stations, and wells to a primary SCADA system. That makes them easy to overlook when staff check only conventional network diagrams or the main internet connection. The modem is a communications path, not proof by itself that an attached controller is publicly reachable or vulnerable; risk depends on routing, configuration, exposure, authentication, and the OT assets behind it.
In a July 30, 2026 alert, CISA said recent activity targeting publicly exposed programmable logic controllers (PLCs) in the water and wastewater sector included modems installed by operators, vendors, or system integrators that “may not be documented or included in routine attack surface scans.” CISA also reported a significant increase in PLC targeting, with cases involving changed passwords, loss of operator access, and PLC disconnection through IP changes. The alert says this activity has resulted in boil-water notices and sustained manual operations; it does not say that all these incidents involved cellular modems. Read CISA’s alert.
The scale of the sector makes a complete, maintained inventory important: NIST’s October 1, 2026 overview describes nearly 50,000 community water systems and more than 16,000 wastewater treatment systems in the United States, and says more than 80% of utilities serve 3,300 people or fewer. These are sector context figures, not estimates of modem exposure or incident counts. NIST’s overview also points to NIST SP 1800-45 as a practical secure-remote-access resource for water and wastewater utilities.
#1 Best Overall
- 【Fast Wi-Fi 6, 3000M wireless speed】GL-X2000 provides reliable cellular networks for remote access and high speed internet in urban areas with up to 574Mbps (2.4GHz) + 2402Mbps (5GHz) Wi-Fi speeds.*Speed Tests conducted on a local network. Real world speeds may differ depending on your network configuration.
- 【Dual-SIM with Single Standby】Dual-SIM flexibility for selecting the stronger and faster ISP connection, AT&T & T-Mobile certificated while supporting Network Failover and the option to configure Failover priorities among multiple connection methods.
- 【Multi-WAN】Spitz Plus' cellular 4G router with multi-WAN technology lets users utilize multiple connection methods, including Ethernet, Repeater, Cellular, and Tethering; Load-balancing capabilities let users distribute bandwidth by custom proportion among multiple connection methods.
- 【VPN Tunnelling & Remote Access】Provides pre-installed OpenVPN and WireGuard to support 30+ VPN services and encrypts all network traffic within the connected network so that the network is secured when connecting to a public Wi-Fi. Max. VPN speed of 30 Mbps (OpenVPN); 190 Mbps (WireGuard) *Speed Tests conducted on a local network. Real world speeds may differ depending on your network configuration.
- 【Interchangeable SMA Connectors】The GL-X2000 features four SMA connectors, allowing for the integration of multiple external antennas to enhance the device's performance across various application scenarios.
How to search for undocumented cellular connections
Use multiple evidence sources. Records can be incomplete, and a logical survey may not see a device that connects through a separate carrier path. The joint CISA, EPA, NSA, FBI, and international-partner asset inventory guidance recommends combining physical inspection, logical survey, documentation, and defined inventory roles and scope. Its water-sector taxonomy is a notional starting point, not a site-validated list. See the joint asset inventory guidance.
- Define the footprint and who owns the inventory. Include treatment, distribution, wastewater treatment and collection, reuse, data management, communications infrastructure, and remote locations. Assign responsibility for gathering and maintaining records across operations, OT/IT, procurement, and relevant vendors or integrators.
- Compare paperwork with the physical sites. Review network diagrams, equipment and configuration records, vendor and integrator documentation, and available service or billing records. Inspect remote tanks, lift stations, wells, and other unattended locations for communications equipment, antennas, power supplies, and attached controllers. Coordinate visits with operations so inspection does not disrupt the process.
- Perform a logical survey as a separate check. Review network and communications information available to your team, including wide-area links and known carrier arrangements. Look for routes that bypass expected boundaries or are absent from diagrams. A scan can help identify visible assets and services, but a clean result does not establish that no independent cellular path exists.
- Resolve discrepancies with the people who installed or maintain the equipment. Ask site staff, integrators, vendors, and telecom contacts to identify the modem’s purpose, carrier arrangement, destination, and attached assets. Reconcile what they report with the equipment observed and the network records rather than treating any one source as definitive.
What to record for each modem and connection
Record enough detail to connect the physical device to its process role, network path, and accountable owner. The joint inventory guidance recommends collecting asset attributes and dependencies; it notes that ports and services can take time to document, so initial attention can go to assets that communicate beyond the OT perimeter or over wide-area networks.
- Identity and location: asset role or type, physical site, manufacturer and model, and any available identifier.
- Network and communications context: IP and network context where applicable, primary communications method, destination or connected network, and ports or services where practical.
- Operational relationship: the controller, RTU, SCADA component, or process the connection supports, plus any relevant network dependencies.
- Accountability: responsible department or owner, vendor or integrator responsibility, operational purpose, and the date the entry was checked.
Do not leave a connection listed only as “cellular.” The inventory should make it possible for another authorized team member to locate the equipment, understand what depends on it, and identify who can explain or change the route.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteDecide whether to remove, retain, or redesign the route
EPA’s July 2024 guidance says utilities should know which SCADA or OT assets connect to the public internet and remove the connection if possible. It specifically calls for checking wireless and cellular paths, not just conventional network links or the main internet modem. For connections that are operationally required, EPA recommends documenting the justification and applying compensating controls. This is voluntary guidance, not a universal legal requirement. Read EPA’s guidance on limiting OT connections to the public internet.
Rank #2
- NEVER GO OFFLINE & ZERO TRUCK ROLLS: Stop paying for expensive on-site technician visits just to reboot a router. The IR302 features an embedded Hardware Watchdog and multi-layer link detection. If the cellular connection drops, the router automatically self-recovers and reconnects for unattended remote sites like EV charging stations, ATMs, smart vending machines, and digital signage
- CERTIFIED FOR MAJOR U.S. CARRIERS & DUAL SIM: Specifically designed for North America (LTE Cat 4 - Model FQ38). It is fully compatible and certified with Verizon, AT&T, and T-Mobile. Equipped with a Dual SIM card slot, it supports seamless Link Failover-if your primary carrier loses signal, it instantly switches to the backup carrier to ensure Always-on connectivity. (Note: SIM cards and data plans are not included)
- ENTERPRISE-GRADE SECURITY & VPN NETWORKING: Protect your critical business data over public cellular networks. The IR302 is equipped with a Stateful Packet Inspection (SPI) firewall, DoS attack defense, and supports comprehensive VPN protocols including OpenVPN, IPsec, WireGuard, and ZeroTier. Easily create secure, encrypted tunnels for remote PLC maintenance or medical equipment diagnostics
- WI-FI, ETHERNET & DIGITAL I/O INTEGRATION: More than just a cellular modem. It features 2x 10/100 Ethernet ports (WAN/LAN switchable), built-in Wi-Fi (802.11 b/g/n) for local wireless access, and with reliable range DC 9-36V power(Included US Power Plug). Unique to this -IO model, it includes 2x Digital I/O (DIO) ports, allowing you to remotely monitor door sensors or trigger physical relays
- RUGGED DESIGN & FREE CLOUD MANAGEMENT: Built for harsh environments with a wide operating temperature of -20C to 70C (-4F to 158F) and DIN-rail mounting. Scale your business effortlessly-connect your router to the InHand Device Manager cloud platform to remotely monitor, configure, and batch-update tens of thousands of distributed routers from a single dashboard
| Disposition | When it fits | What to do |
|---|---|---|
| Remove the connection | The internet route is not needed for the process or support function. | Coordinate the change with operations and the responsible owner; update the inventory and relevant diagrams after verifying the operational effect. |
| Retain with controls | The connection has a documented operational purpose and cannot reasonably be removed. | Record the reason and owner, then apply controls suited to the system, such as mediated access, MFA, firewalling, and centralized logging. |
| Redesign remote access | Support is needed, but the current path exposes a PLC or OT asset directly. | Use a VPN or gateway as an access intermediary rather than direct access to the PLC; review identity, allowed sources, network rules, and monitoring. |
This is a practical decision aid synthesized from EPA, CISA, and joint inventory guidance, not a published agency framework. Evaluate each route against operational necessity, exposure and access controls, inventory and ownership confidence, and recovery readiness.
Controls for connections that must remain
For a retained connection, first understand what the modem can reach and who can use it. EPA names MFA, firewalls, and centralized logging as compensating controls for required OT internet connections, and says utilities should use telecom-provider private networks for cellular modems whenever possible. CISA recommends remote OT access through a VPN or gateway instead of directly to a PLC, along with password protection, changing default passwords, and IP allowlisting. EPA’s revised water-sector cybersecurity guidance includes MFA for remote OT access and backup practices.
- Use an approved VPN or gateway to mediate remote OT access; avoid direct public access to a PLC.
- Require MFA where supported, protect accounts with strong authentication practices, and replace default passwords.
- Apply firewall rules and allow access only from known, authorized source IP addresses where appropriate and operationally feasible.
- Send relevant access and system events to centralized logging so activity can be reviewed.
- Prefer a telecom-provider private network for cellular connectivity when available and appropriate, while still documenting and controlling the route.
These controls are not interchangeable checkboxes. Select and verify them against the modem’s actual configuration, attached equipment, support arrangements, and operational constraints.
Respond safely if you find an exposed or unknown path
Do not abruptly disconnect a modem or controller solely because it is unfamiliar. First coordinate with operations and the asset owner to establish what process depends on it, what loss of communications would mean, and how to make the change safely. If the connection appears exposed or unauthorized, involve the utility’s incident-response and OT personnel, preserve relevant records, and follow established safety and response procedures.
Rank #3
- 【SMART 4G TO WI-FI CONVERTER】Come with a standard nano-SIM card slot that can transfer 4G LTE signal to Wi-Fi networking. Up to 300Mbps (2.4GHz ONLY) Wi-Fi speeds. It can move into a 4G LTE wireless network if the Ethernet Internet fails, in order to ensure constant data transmission.
- 【OPEN SOURCE & PROGRAMMABLE】OpenWrt pre-installed, unlocked, extremely extendable in functions, perfect for DIY projects. 128MB RAM, 16MB NOR + 128MB NAND Flash. Dual Ethernet ports, USB 2.0 port, Antenna SMA mount holes reserved.
- 【SECURITY & PRIVACY】OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. With our brand-new Web UI, you can set up VPN servers and clients easily. IPv6, WPA3, and Cloudfare supported. Level up your online security.
- 【Easy Configuration with Web UI and GoodCloud】GoodCloud allows you manage and monitor devices anytime, anywhere. You can view the real-time statistics, set up a VPN server and client, manage the client connection list, and remote SSH to your IoT devices. The built-in 4G modem supports AT command, manual/automatic dial number, SMS checking, and signal strength checking in Web UI for better management and configuration.
- 【PACKAGE CONTENTS】GL-XE300-AF 4G LTE Portable IoT Gateway (2-year Warranty) X1, Ethernet cable X1, 5V/2A power adapter X1, User manual X1, Quectel EC25-AF 4G module pre-installed. Please refer to the online docs for first set up.
Where CISA’s alert calls for disconnecting exposed PLCs, it also advises retaining a known-clean PLC image backup. EPA recommends regular backups and testing. Before removing connectivity, ensure the utility understands the recovery path and the effects on monitoring, control, alarms, and vendor support; document the change and verify the process afterward. CISA’s recommendations and threat context are in its July 30, 2026 alert.
Keep the inventory useful after discovery
An inventory is a recurring operating process, not a one-time scan. EPA’s revised August 2024 guidance recommends reviewing the OT/IT asset list at least quarterly and including legacy and third-party equipment. Give every discovered path an owner and review date, and update records when sites, vendors, communications arrangements, or network dependencies change.
For implementation planning, NIST’s October 2026 overview points to NIST SP 1800-45 for practical approaches to secure OT remote access in water and wastewater utilities. Treat it as an implementation resource to adapt to the utility’s architecture and operational needs, not as a universal design.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
