Unpatchable Rockwell PLC Flaw Exposes 5,200+ Devices as Iranian Hackers Breach U.S. Water Systems

Detail

cannot and will not be patched. The authentication system itself must be redesigned from the ground up, a move that would break compatibility with every Logix controller already in the field. As of April 2026, Censys identified

"This is not a patch-delay situation. This is a fundamental architectural flaw where the cryptographic key used to verify legitimate engineering software can be extracted and reused by anyone. Rockwell's admission that no fix is forthcoming makes CVE-2021-22681 one of the most consequential OT vulnerabilities ever disclosed." ,

First disclosed in February 2021, CVE-2021-22681 resides in the authentication mechanism used by Rockwell Automation's Studio 5000 Logix Designer and RSLogix 5000 software to verify communications with Logix controllers. The vulnerability stems from

, specifically, a private key used to authenticate engineering software sessions that can be extracted and exploited by any remote, unauthenticated attacker.

, the flaw allows an attacker to bypass verification entirely, connect to a Logix controller, and make arbitrary changes to controller configuration and application code. Rockwell rated the exploitability as "low complexity" , meaning no specialized conditions are required for successful exploitation.

ControlLogix, CompactLogix, GuardLogix, and all Logix-family controllers using RSLogix 5000 / Studio 5000

Apply mitigations per vendor instructions, follow BOD 22-01 guidance, or discontinue use