A CVSS 10.0 From 2021 Just Became Iranian Tradecraft. It Was Never Really Patchable — the Fix Is a Physical Switch on the Front of the Controller.

Tenable's mid-2026 write-up on CyberAv3ngers contains one line that changes how you should read this group. Alongside the familiar material — IOCONTROL, the water utilities, the joint advisory — they note exploitation of [CVE-2021-22681](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2021-22681).

That CVE is from 2021. It carries a CVSS of 10.0. And CISA only added it to the Known Exploited Vulnerabilities catalog on 5 March 2026 — five years after disclosure.

We have the KEV entry in our index. We have never written about it. That is the gap this post closes, and the interesting part is not the bug. It is that this one was never really patchable, and the mitigation that actually works is a key you turn with your hand.

What the vulnerability actually is

Rockwell's Studio 5000 Logix Designer is the software engineers use to write and load logic onto Logix controllers — CompactLogix, ControlLogix, GuardLogix, DriveLogix, SoftLogix.

For a controller to accept new logic, it needs to know it is talking to genuine engineering software rather than something pretending. Rockwell solved that with a shared secret cryptographic key, baked into Studio 5000, which the controller uses to verify the other end.

Researchers at Claroty's Team82, Kaspersky, and Soonchunhyang University in South Korea independently found the same thing in early 2021: that key can be extracted from the software.

Once you hold it, the controller believes you are the engineering workstation. Not "you can crash it." Not "you can read from it." You can upload and download control logic, change the configuration, and install firmware — the full authority an engineer has, because as far as the controller is concerned you are the engineer.

The only precondition is network access to the controller.

Why it sat for five years

Because there is no clean patch, and there could not be. The defect is not a memory-handling mistake you correct in a function. The defect is the trust model. Possession of a shared secret is the entire identity check — there is no per-workstation credential and no certificate to fall back on. You cannot ship an update that makes a leaked shared key un-leaked.

Rockwell's guidance in 2021 reflected that. It was not "install this." It was a combination of version upgrades, network segmentation, keeping controllers off the internet, and — the one that matters most — putting the physical keyswitch on the front of the controller into RUN.

In RUN, the controller refuses logic changes at the hardware level. It does not matter what key you hold or how perfectly you impersonate the engineering station. The controller will not take new logic because a metal switch says no.

That is an unusual and slightly wonderful property. In a field where every control eventually reduces to more software, this one reduces to a person walking to a cabinet.

It is also why the bug survives. A keyswitch in PROGRAM is convenient. Remote engineering support needs it. Integrators leave it there. Five years of convenience is how a 2021 CVSS 10.0 is still worth an APT's time in 2026.

The actor climbed a rung, and that is the real news

In late 2023 CyberAv3ngers went after Unitronics Vision PLCs at small water utilities, most famously the Municipal Water Authority of Aliquippa in Pennsylvania. The technique was the default password. It was 1111.

That is not an exploit. That is walking through an unlocked door, and it worked because nobody had changed the factory setting.

Exploiting CVE-2021-22681 is a different tier. It requires understanding a vendor's authentication design, obtaining the key, and speaking the protocol convincingly enough that an industrial controller accepts you as its engineering station.

Same group, three years apart, and the capability gap between those two operations is the entire story. It also fits what the July advisory update describes — a widening target set that now names Schneider Electric and Siemens hardware alongside Rockwell, and cellular modem access over SSH. This is not a crew running one trick against one vendor any more.

What makes it worse, from our own measurement

Here is where our week's work connects, and it is not comfortable.

On 31 July we measured the disclosure surface across three industrial protocols. On EtherNet/IP — port 44818, the protocol Logix controllers speak — 61,121 US hosts responded, and 2,967 of those volunteer device identity: vendor, product name, serial number. Passive Shodan host counts, indicative rather than exact, no packets sent by us.

Separately, examining Modbus hosts, we found controllers publishing their project metadata — the engineering workstation's machine name, the operator's Windows username, the vendor software in use, and the full project file path. We wrote that up on 1 August in the context of Schneider's IGSS advisory.

Put those two facts against CVE-2021-22681 and the picture sharpens considerably.

The vulnerability lets an attacker impersonate the engineering station. The exposed controllers tell you which engineering station to impersonate — its name, its user, its software, its directory layout. One publishes the target of the impersonation; the other supplies the means.

We have not observed anyone chaining those two things. Nobody has reported it. We are describing what the pieces make possible, which is a different claim and a weaker one, and we would rather make the weaker claim accurately.

What to actually do

Turn the keyswitch to RUN. This is first because it is the only control that holds when everything else has failed, and because it costs a walk to a cabinet. If remote programming is genuinely required, make it an exception with a defined window rather than the standing state.

Get the controller off the internet. CISA's guidance in the July advisory update is unambiguous: remove publicly exposed PLCs and OT from the internet. Of those 61,121 responding US endpoints, the honest answer for most is that nobody decided they should be reachable — a cellular router or a remote-support contract made them reachable, years ago, and nobody revisited it.

Upgrade past the affected versions and segment. Rockwell's original guidance still stands, and CIP Security exists now in a way it did not in 2021.

Stop letting the controller introduce itself. If it is announcing vendor, product, serial and project path to unauthenticated strangers, that is free reconnaissance. Some of that is fixable in configuration; some needs the device off the public internet, which is the same answer as above.

And check the keyswitch position on every controller you own, not just the ones you think are exposed. Position is state, and state drifts. Nobody logs a keyswitch.

What we are not claiming

We did not discover this vulnerability — Claroty Team82, Kaspersky and the Soonchunhyang University researchers did, in 2021, and the technical write-up worth your time is Claroty's. The CyberAv3ngers attribution is Tenable's, made on operational-pattern grounds, and it is their call rather than ours.

We hold no indicator for this technique. Our AA26-097A lane is 21 IP addresses — an exact match against CISA's published set, which contains no file hashes and no domains — and none of them is attributable to this specific CVE.

What is ours is the measurement: the 61,121, the 2,967, and the project-metadata disclosure. And the observation that a five-year-old unpatched-by-design trust flaw, plus a controller that volunteers who to impersonate, is a worse combination than either fact reads on its own.

The fix is still a switch on the front of the box. It was in 2021 too.

Sources: Claroty Team82 — Critical Authentication Bypass in Rockwell Software · NVD — CVE-2021-22681 · Tenable — CyberAv3ngers FAQ · CISA AA26-097A

---

Every indicator in this post is in the feed. Free.

1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.

Get your free key → analytics.dugganusa.com/stix/register