A serial to Ethernet converter makes an RS232 or RS485 device accessible through an Ethernet network. This is useful for remote monitoring and control, but it also creates a new question for manufacturers:
Who is actually allowed to access the serial port?
This matters when the converter is connected to a PLC, meter, controller, alarm system, or other equipment that should not accept commands from every device on the network.
Recent security research has shown that serial-to-Ethernet converters can become an attack path into industrial and other critical systems when they are exposed or poorly protected. Research cited in a recent security discussion found vulnerabilities in multiple converter products and highlighted risks including authentication bypass and denial-of-service attacks. It also found that a significant number of these devices were exposed online.
The practical lesson is not to stop using serial networking. It is tocontrol who can reach the serial port and how that connection is protected.
Consider a factory where a PLC communicates through RS485 and a serial to Ethernet converter provides remote access.
A common but risky setup is:
PLC → Serial to Ethernet converter → Internet
If the converter's TCP service is directly reachable from the Internet, the serial port is no longer isolated from external network traffic.
A safer architecture is:
PLC → Serial to Ethernet converter → Industrial LAN → Firewall/VPN → Authorized users
The converter should normally sit inside the industrial network. Remote engineers can reach the required network through a VPN rather than exposing the converter's TCP service directly to the Internet.
This is the first access-control rule:
If a device does not need to be Internet-facing, don't make it Internet-facing.
In many factories, only one SCADA server or one engineering workstation needs to communicate with a particular PLC.
There is no reason for every PC on the factory network to have access.
For example:
SCADA server: allowed
Engineering workstation: allowed when maintenance is required
Office PCs: blocked
Guest Wi-Fi: blocked
Public Internet: blocked
This can be implemented with firewall rules or network ACLs.
For a TCP-based serial connection, the rule can be as simple as:
Allow:SCADA server IP → serial converter IP + required TCP port
Deny:all other sources
This approach is often more practical than trying to solve every security problem inside the serial converter itself.
It also makes the system easier to audit: when someone asks who can access the PLC, the network rule clearly defines the answer.
A VLAN is another useful layer of protection.
For example:
VLAN 10 — Industrial Control
PLC, RTU, meters, serial converters
VLAN 20 — Engineering
Maintenance computers
VLAN 30 — Office
Employee PCs
VLAN 40 — Guest
Visitors and temporary devices
The firewall can then control traffic between these networks.
For example, engineering PCs may be allowed to access the serial converter, while office and guest networks cannot.
This is particularly useful when one serial converter is used to connect equipment that has been running for many years. You may not be able to change the PLC's communication protocol or security model, but you can still control which network devices are allowed to reach it.
Access control answers one question:
Who can connect?
Encryption answers another:
Can someone read or modify the communication while it is being transmitted?
These are different problems.
The USR-TCP232-410s supports TCP Client/Server and other network modes, and provides SSL/TLS encryption for supported TCP client, HTTP client and MQTT operation modes. It also supports two-way certificate authentication.
This is useful when serial data needs to travel beyond a trusted local network.
For example:
RS485 meter → serial to Ethernet converter → secure network connection → monitoring server
Instead of relying only on an isolated network, encrypted communication can provide additional protection against interception or tampering.
But encryption should not be treated as a replacement for network access control.
A good design uses both:
Network segmentation + firewall rules + secure communication
Transparent transmission is one of the main reasons manufacturers use a serial to Ethernet converter.
The converter can transfer serial data over TCP/IP without requiring major changes to the existing PLC or controller. The USR-TCP232-410s supports bidirectional transparent transmission and can connect traditional RS232/RS485 devices to TCP/IP networks.
The advantage is simplicity.
The security consideration is also simple:
If a user can establish a valid network connection to the serial port, the user may be able to send data toward the connected serial device.
That is why access control should be designed around the actual communication path.
Before deployment, ask:
Which devices need to read serial data?
Which devices are allowed to send commands?
Does remote maintenance really need write access?
Can office or guest networks reach the converter?
Does remote access go through a VPN?
Is the converter's TCP service exposed to the public Internet?
These questions are usually more useful than simply asking whether a converter is advertised as "secure."
Not every user who needs toreaddata should be allowed tocontrolequipment.
For example, a factory may have:
Production monitoring → needs PLC data
Maintenance team → needs configuration access
Control system → needs read/write communication
Management dashboard → only needs selected operating data
If the architecture allows it, give each system only the access it actually needs.
This is especially important for equipment where an unexpected command can affect production.
For a manufacturer evaluating a serial to Ethernet converter, the key question should therefore be broader than:
"Does it support RS485?"
Also ask:
"How will I control access to the network service connected to my RS485 device?"
Before connecting a serial to Ethernet converter to a production device, check the following:
Do not expose the converter directly to the public Internet.
Place industrial devices on an appropriate VLAN or protected network.
Allow access only from required servers or workstations.
Block office and guest networks unless access is necessary.
Use VPN for remote maintenance where appropriate.
Identify which devices can read the serial port.
Identify which devices can send commands.
Avoid giving unnecessary users write access.
Document the TCP/UDP service and port used by the application.
Use SSL/TLS where supported and appropriate.
Use certificate-based authentication when available.
Keep firmware and security configurations under controlled maintenance.
Review exposed services before putting the device into production.
Record who is authorized to access each converter.
Remove temporary maintenance access when the work is finished.
Monitor unusual connection attempts.
Test firewall rules before connecting the converter to a live PLC.
A serial to Ethernet converter is often a small device, but it can sit directly between a network and an important industrial controller.
The safest approach is not to rely on a single security feature.
Instead, build several simple controls around the communication path:
Keep the converter off the public Internet → segment the industrial network → allow only authorized hosts → use VPN for remote access → encrypt supported connections.
For applications that need both RS232 and RS485 connectivity, the USR-TCP232-410s provides two serial ports that can operate simultaneously, TCP/IP networking, SSL/TLS support, and industrial operating-temperature capability from -40°C to +85°C.
The important point is that securing a serial port is not only a question of choosing a "secure" converter. It is about decidingexactly who should be able to reach the serial device—and preventing everyone else from reaching it.
