In many factories, PLCs, power meters, instruments, and controllers still rely on RS232 or RS485 interfaces, while MES, SCADA, and data platforms already operate over Ethernet networks. The most straightforward way to connect these legacy devices is to deploy an RS485 to Ethernet converter or an RS232 to Ethernet converter.
However, once an Ethernet cable is connected, the security boundary changes as well.
Traditionally, a serial device only communicated through a physical serial cable. Once connected to a LAN, it enters a network-accessible environment for the first time. Recent security research on serial-to-Ethernet devices analyzed firmware from multiple vendors and found that these devices contained, on average, around 80 open-source components and nearly 2,500 known vulnerabilities. Researchers also identified additional issues such as authentication bypass, remote code execution, information disclosure, and denial-of-service vulnerabilities.
More importantly, even if a device is not directly exposed to the Internet, an attacker who has already gained access to the corporate network may still be able to move laterally and reach these devices.
Therefore, the key to secure connectivity is not simply asking whether a device can be connected to the network. The real priority is toreduce and control the paths through which it can be accessed.
The first rule is simple:do not expose a serial to Ethernet converter directly to the public Internet.
For remote commissioning or maintenance, some projects assign the device a public IP address, configure port forwarding or NAT, and leave a TCP Server port permanently open. This can turn a serial device that was previously accessible only on-site into a network-reachable target.
A safer approach is to keep the serial to Ethernet converter inside the enterprise network. When remote maintenance is required, engineers should access the OT network through a VPN, dedicated line, or another controlled remote-access channel.
CISA guidance for industrial control systems similarly recommends reducing Internet exposure of OT devices and controlling connectivity through firewalls, network segmentation, and secure remote access.
If the application only needs to send field data to a central server, another option is to configure the device as a TCP Client or MQTT Client so that it initiates the connection to the server. This can reduce the number of inbound ports that need to remain permanently open.
The second step is network segmentation.
Serial to Ethernet converters, PLCs, instruments, and other OT devices should ideally be placed in a dedicated VLAN rather than sharing a LAN where office computers, printers, and guest Wi-Fi devices can communicate freely with them.
Separating IT and OT networks and using firewall policies to block unnecessary traffic are common defense-in-depth practices in industrial networks.
For example, if a serial to Ethernet converter only needs to send Modbus data to a SCADA Server, the access rule can be restricted to:
Specified SCADA Server IP ↔ Specified serial to Ethernet converter IP + required service ports
If office PCs or general-purpose servers have no operational reason to access the device, they should not be allowed to do so.
This is much safer than assuming that “everything is inside the LAN, so it is secure.” The real risk is that once one endpoint on the enterprise LAN is compromised, an attacker may attempt to move laterally toward the OT network.
Many legacy devices use Modbus RTU or transparent serial communication. These protocols were not originally designed with complete authentication or encrypted transmission for modern IP networks.
Therefore, when data needs to travel between buildings, across factory sites, or through a network that cannot be fully trusted, encryption should be added to the Ethernet portion of the communication path.
Take the PUSR USR-TCP232-410s as an example. It provides both RS232 and RS485 interfaces, allowing both types of serial devices to be connected, and it supports Modbus RTU/TCP conversion.
When deployed as an RS232 to Ethernet converter or RS485 to Ethernet converter, it also supports SSL/TLS encryption in modes such as TCP Client, HTTP Client, and MQTT, along with mutual certificate authentication.
However, one point needs to be clear:
SSL/TLS protects the communication channel, but it does not replace network segmentation.
A more reliable security design combines:
Network segmentation + least-privilege access + encrypted transmission
None of these layers should be treated as optional.
Another commonly overlooked issue is thattransmitting serial data and modifying the configuration of a serial to Ethernet converter are two different types of access.
After deployment, management interfaces such as Web configuration pages and configuration tools should ideally be accessible only from authorized maintenance computers or dedicated management network segments.
Unused operating modes, network services, and listening ports should be disabled. Default usernames and passwords should also be changed before the project is handed over.
CISA's OT security recommendations similarly include changing default credentials, disabling unnecessary services and ports, and restricting access to device management interfaces.
Another practical issue is that a serial to Ethernet converter may remain installed for many years. Once communication is working, it can easily become a device that nobody checks again unless something fails.
For this reason, it is a good practice to include the following information in the device asset inventory:
Model, IP address, MAC address, installation location, firmware version, open ports, and corresponding business system
The availability of firmware updates and security fixes from the manufacturer should also be reviewed periodically.
This makes it much easier to answer a basic but important question when a new security advisory appears:
Do we actually have any affected devices deployed in our facilities?
When purchasing anRS232 to Ethernet converterorRS485 to Ethernet converter, it is natural to compare the number of serial ports, supported baud rates, Modbus conversion capabilities, and suitability for industrial environments.
However, if the device will be connected to an enterprise LAN, several additional questions should also be considered:
Does the device support encrypted transmission and certificate authentication? Can access to the management interface be restricted? Can unused services and ports be disabled? Is the firmware actively maintained? Can the device be easily integrated into VLAN, ACL, and firewall policies?
For applications where both RS232 and RS485 devices are used on-site and data must be securely transmitted to a server or IoT platform, a device such as the USR-TCP232-410s, which supports dual serial interfaces, Modbus gateway functions, and SSL/TLS, can reduce the need for additional conversion devices and make network boundaries easier to plan and manage.
Connecting RS232 and RS485 devices to Ethernet does not automatically make them insecure.
The greater risk appears whenthe device has been connected to the network, but its access controls are still managed as if it were only connected through a traditional serial cable.
A practical deployment sequence is straightforward:
First, avoid direct Internet exposure. Then apply network segmentation and IP/port access restrictions. Enable SSL/TLS when communication passes through untrusted networks. Finally, maintain long-term control over management permissions, firmware versions, and device asset records.
In this way, a serial to Ethernet converter does more than simply convert a serial interface into an Ethernet connection. It provides a more controlled way to integrate traditional RS232 and RS485 devices into modern Ethernet networks without requiring major changes to existing industrial equipment.
