UPDATE — water-sector PLC lockout status: an OT vendor's decade retrospective attributes the Minnesota controller intrusions to a CVE whose own record names a different Rockwell product family, and the campaign still has no CVE and no actor named by any investigating body
UPDATE · originally covered Water-sector PLC lockout status: the FBI has now named the targeted controller family — Rockwell MicroLogix 1100 and 1400 — while still declining to name an actor, and a 300,000-customer boil-water advisory in Georgia is the largest disclosed population impact so far (2026-08-09)
the prior weekly recorded the water-sector PLC lockout campaign in a state that had held since it began — a device family European operators could inventory, an operational effect on real utilities, and an attribution that no US authority would make. This week produced the campaign's first vendor attribution to a specific vulnerability, and it does not survive a check against that vulnerability's own record.
Dragos published a decade-spanning retrospective on 13 August setting the 2013 Bowman Dam intrusion against the July 2026 Minnesota campaign. Its description of the target is consistent with everything published before: "Attackers reached MicroLogix 1100 and 1400 series programmable logic controllers that were directly exposed to the internet through cellular links at water towers and lift stations." The new claim is the mechanism: "In Minnesota, it was dozens of PLCs reachable over cellular links, exploitable through a known authentication bypass vulnerability, (CVE-2021-22681) that was first disclosed in 2021 and added to CISA's Known Exploited Vulnerabilities catalog in March 2026, five years after initial disclosure" (Dragos, 2026-08-13). Half of that checks out: CISA added CVE-2021-22681 to the catalogue on 5 March 2026 (CISA Known Exploited Vulnerabilities catalog, 2026-08-16).
The product scope does not. CISA's own ICS advisory for that CVE is titled "Rockwell Automation Logix Controllers", and states that "Studio 5000 Logix Designer uses a key to verify Logix controllers are communicating with the affected Rockwell Automation products", with successful exploitation allowing "a remote unauthenticated attacker to bypass the verification mechanism and connect with Logix controllers". The products it lists as affected are RSLogix 5000 versions 16 through 20, Studio 5000 Logix Designer version 21 and later, and FactoryTalk Security version 2.10 and later (CISA ICS advisory ICSA-21-056-03, 2021-02-25). MicroLogix appears nowhere in it, and the flaw concerns a key used by Rockwell's Logix engineering software to verify Logix controllers — a different product line and a different mechanism from the MicroLogix 1100 and 1400 units Dragos names two paragraphs earlier. CISA's catalogue summary frames it the same way, around Studio 5000 Logix Designer and Logix controllers. The same advisory records a second divergence from Dragos's account that is worth stating given this entry's subject: Dragos gives the flaw a CVSS score of 9.8, while CISA's advisory reads "A CVSS v3 base score of 10.0 has been calculated". This entry carries CISA's 10.0, and notes that the advisory also records that Rockwell "has determined this vulnerability cannot be mitigated with a patch" — so a reader who took the retrospective's framing and went looking for a patch to apply would find none. What the FBI and EPA have published about Minnesota, and what this pipeline recorded from that reporting, describes no vulnerability at all: attackers reached internet-exposed controllers, changed their IP addresses and passwords, and locked operators out — reachability plus credential control.
Triage: unchanged from prior coverage, because the technique is unchanged. The observables for this campaign are administrative rather than exploit-shaped: a controller-mode or configuration change with no corresponding maintenance window, a management session to a field device originating from outside the engineering workstation subnet — particularly from the carrier-side of a cellular router rather than from the operator's own network — and credential or network-configuration changes on a controller that the engineering team cannot attribute to a change record. Legitimate remote maintenance produces the same protocol events, which is why origin and change-record correlation, not the event type, is what separates them.
In Minnesota, it was dozens of PLCs reachable over cellular links, exploitable through a known authentication bypass vulnerability, (CVE-2021-22681) that was first disclosed in 2021 and added to CISA’s Known Exploited Vulnerabilities catalog in March 2026, five years after initial disclosure.
Attackers reached MicroLogix 1100 and 1400 series programmable logic controllers that were directly exposed to the internet through cellular links at water towers and lift stations.
Studio 5000 Logix Designer uses a key to verify Logix controllers are communicating with the affected Rockwell Automation products.
Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to bypass the verification mechanism and connect with Logix controllers.
ATT&CK mapping
3 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1078.001Valid Accounts: Default Accounts
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
T1133External Remote Services
Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Persistence TA0003
T1078.001Valid Accounts: Default Accounts
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
T1133External Remote Services
Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.
Privilege Escalation TA0004
T1078.001Valid Accounts: Default Accounts
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
Stealth TA0005
T1078.001Valid Accounts: Default Accounts
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
Sources
Update chain
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.