CVE-2021-22681

Rockwell Multiple Products Insufficient Protected Credentials

9.8 CRITICALActively exploited (CISA KEV)EPSS 63.6%

Published3 Mar 2021
Added to CISA KEV5 Mar 2026
Remediation due26 Mar 2026

Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controllers are communicating with Rockwell Automation design software. If successfully exploited, this vulnerability could allow an unauthorized application to connect with Logix controllers. To leverage this vulnerability, an unauthorized user would require network access to the controller.

Added to KEV: 5 Mar 2026Federal remediation due: 26 Mar 2026

Description

Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Rockwellautomation Factorytalk Services Platform≥ 2.10

Rockwellautomation Rslogix 5000≥ 16 ≤ 20

Rockwellautomation Studio 5000 Logix Designer≥ 21.0

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

https://us-cert.cisa.gov/ics/advisories/icsa-21-056-03Third Party AdvisoryUS Government Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22681US Government Resource

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2021-22681 being actively exploited?

Yes. CVE-2021-22681 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 5 Mar 2026.

How severe is CVE-2021-22681?

CVE-2021-22681 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 63.6% probability of exploitation.

Which products are affected by CVE-2021-22681?

Affected products include Rockwellautomation Factorytalk Services Platform, Rockwellautomation Rslogix 5000, Rockwellautomation Studio 5000 Logix Designer.

How do I fix CVE-2021-22681?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2021-22681 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.