Back to Incidents Registry
NIST-CVE-2021-32944NIST REGISTRYIndustrial Control Systems & SCADA

CISA Advisory ICSA-21-084: SCADA Modbus PLC Stale Register Latching

Incident Failure Topology Brief
Critical Multi-Node (Level 4)Sev 8.5/10

Network buffer congestion desynchronized PLC internal registers from physical sensors. Status telemetry reported healthy communication while physical Constraint_Boundary was breached.

Failure Invariant Breach
Physical containment breach
Absent Safety Recovery Mechanism
Heartbeat timestamp verification and automatic stale-data greying
Domain De-Aliasing & Jargon Stripping
Raw Domain Record (Subjective Narrative)

Under high broadcast network packet loads, programmable logic controllers (PLCs) in water treatment facilities stopped updating holding registers while continuing to respond with HTTP 200/OK status, displaying steady-state chlorine levels while physical tanks overflowed.

PatternDB Invariant Representation

Network buffer congestion desynchronized PLC internal registers from physical sensors. Status telemetry reported healthy communication while physical Constraint_Boundary was breached.

Causal Failure Topology & State Vectors
4 Sequential Invariant Breaches
STEP 01DEGRADE
Ethernet_Switch

Forwarded broadcast storm exceeding PLC packet queue depth

Vector: Buffer overflow
STEP 02DEGRADE
Modbus_Task

Froze internal state update thread while keep-alive thread responded OK

Vector: Silent state desync
STEP 03DEGRADE
SCADA_HMI

Rendered static green bar showing 1.2 ppm chlorine for 5 hours

Vector: Stale telemetry display
STEP 04RUPTURE
Chemical_Storage

Overflowed 8,000 gallons of chemical into containment dykes

Vector: Physical containment breach
Decision Nodes Involved
Plant Supervisory Control Operator
Automated Dosing Logic
Telemetry Channels
Modbus TCP Industrial Ethernet Gateway
Constraint Boundaries Breached
Chemical Tank Hydraulic Capacity & Chlorine Parts-Per-Million Ceiling
Official Regulatory Audit Citation
NIST RegistryNIST-CVE-2021-32944
Incident Official DateMar 25, 2021
Quantified Systemic Loss$2,100,000 Chemical Loss & Environmental Remediation
Primary Investigation Transcripts:

"The operator screen showed nominal operations while the physical plant was in an overflow condition."

Immutable Archive RecordVerify at NIST Primary Database

Cross-Domain Invariant Twin Failures (41)

Cross-Domain Invariant Twin
100% Topological MatchΔ 0.000
NIST-CVE-2021-32944Industrial Control Systems & SCADA
CISA Advisory ICSA-21-084: SCADA Modbus PLC Stale Register Latching

Network buffer congestion desynchronized PLC internal registers from physical sensors. Status telemetry reported healthy communication while physical Constraint_Boundary was breached.

Source Authority:NIST
FAA-AD-2018-23-51Aerospace & Avionics
FAA Emergency Airworthiness Directive: AOA Resolver Stale State Freezes

Physical sensor state frozen due to hardware anomaly. Telemetry_Channel continued latching last-known good values to Decision_Node without state invalidation timestamp.

Source Authority:FAA
Shared Failure Vector: Physical_Sensor -> Driver_Buffer -> Display_Node (Stale Value Latch)
Deep Compare
Cross-Domain Invariant Twin
100% Topological MatchΔ 0.000
NIST-CVE-2021-32944Industrial Control Systems & SCADA
CISA Advisory ICSA-21-084: SCADA Modbus PLC Stale Register Latching

Network buffer congestion desynchronized PLC internal registers from physical sensors. Status telemetry reported healthy communication while physical Constraint_Boundary was breached.

Source Authority:NIST
BEA-AAR-2009-0601Commercial Aviation
Air France Flight 447: Pitot Tube High-Altitude Icing & Dual Side-Stick Cancellation

Transient physical Telemetry_Channel blockage triggered automation disconnect. Decision_Node executed continuous contradictory control inputs, which remained unobserved by supervisory node due to decoupled side-stick physical telemetry.

Source Authority:FAA
Shared Failure Vector: Physical_Sensor -> Driver_Buffer -> Display_Node (Stale Value Latch)
Deep Compare
Cross-Domain Invariant Twin
100% Topological MatchΔ 0.000
NIST-CVE-2021-32944Industrial Control Systems & SCADA
CISA Advisory ICSA-21-084: SCADA Modbus PLC Stale Register Latching

Network buffer congestion desynchronized PLC internal registers from physical sensors. Status telemetry reported healthy communication while physical Constraint_Boundary was breached.

Source Authority:NIST
NASA-OIG-2024-0824Human Spaceflight & Propulsion
Boeing Starliner CFT-1: Helium Flange Leaks & Reaction Control Thruster Thermal Deselection

Thermal saturation degraded physical valve seal Buffer_Reserves. Flight control software automated health checks detected performance delta and permanently deselected thruster Decision_Nodes, trapping spacecraft in degraded operational state.

Source Authority:NIST
Shared Failure Vector: Physical_Sensor -> Driver_Buffer -> Display_Node (Stale Value Latch)
Deep Compare