CVE-2021-22681
Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
Description
CVE-2021-22681 is a CRITICAL severity vulnerability (CVSS 9.8) involving insufficiently protected credentials (CWE-522) in Rockwell Automation products. Studio 5000 Logix Designer versions V21 and later, as well as RSLogix 5000 versions V16 through V20, use a cryptographic key to verify communication with Logix controllers. An unauthenticated remote attacker who obtains this key can bypass the verification mechanism and authenticate with multiple Rockwell Automation controller product families, including CompactLogix, ControlLogix, DriveLogix, GuardLogix, and SoftLogix. With a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, the vulnerability is exploitable over the network with no authentication or user interaction required. CISA added CVE-2021-22681 to the Known Exploited Vulnerabilities catalog on March 5, 2026, with a remediation deadline of March 26, 2026. The EPSS score of 0.180 (18.0th percentile) indicates meaningful exploitation probability, particularly concerning given the critical role of programmable logic controllers in industrial control systems.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| rockwellautomation | factorytalk services platform | >= 2.10 |
| rockwellautomation | rslogix 5000 | >= 16, <= 20 |
| rockwellautomation | studio 5000 logix designer | >= 21.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://us-cert.cisa.gov/ics/advisories/icsa-21-056-03(Third Party Advisory, US Government Resource)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22681(US Government Resource)
Weakness Type
CWE-522: Insufficiently Protected Credentials
Insufficiently Protected Credentials (CWE-522) is a vulnerability class where a system transmits or stores authentication credentials using methods that do not provide adequate protection against unauthorized access. This weakness can manifest as credentials stored in plaintext, transmitted without encryption, embedded in source code, or protected with insufficient cryptographic mechanisms. When credentials are inadequately protected, attackers can intercept, extract, or reverse-engineer them to gain unauthorized access to systems and resources.
In CVE-2021-22681, the Rockwell Automation Studio 5000 Logix Designer and RSLogix 5000 development environments use a shared cryptographic key to verify the identity of Logix controllers during communication sessions. This key is not sufficiently protected and can be extracted by an attacker who gains access to the engineering workstation software or network traffic. Once in possession of the key, the attacker can impersonate a legitimate engineering workstation and establish authenticated sessions with any of the affected controller families (CompactLogix, ControlLogix, DriveLogix, GuardLogix, SoftLogix), bypassing the authentication mechanism entirely. This grants the attacker the ability to read and modify controller logic, change operating parameters, and disrupt industrial processes.
Impact Analysis
CVE-2021-22681 carries a CVSS 3.1 base score of 9.8 (CRITICAL), reflecting the potential for complete compromise of affected industrial control systems.
Confidentiality (High): An attacker who obtains the verification key gains read access to the controller's programmed logic, configuration parameters, operational data, and process variables. In industrial environments, this information can reveal proprietary manufacturing processes, safety system configurations, and operational details that constitute sensitive intellectual property or could be used to plan more targeted attacks.
Integrity (High): The most dangerous aspect of this vulnerability is the ability to modify controller logic and operating parameters. An attacker with write access to a programmable logic controller can alter process control sequences, change safety thresholds, modify alarm configurations, or inject malicious ladder logic. In safety-critical applications such as chemical processing, power generation, or manufacturing, unauthorized modifications to controller logic can create dangerous physical conditions.
Availability (High): An attacker can disrupt controller operation by halting the processor, clearing program memory, or placing the controller in a fault state. Since Logix controllers typically manage real-time industrial processes, any disruption to controller availability can cause immediate production outages, equipment damage, or safety incidents depending on the application.
Scope (Unchanged): While the vulnerability's direct impact is on the controller systems, the consequences extend to the physical processes they control. The EPSS score of 0.180 indicates notable exploitation interest, which is significant in the ICS context where even low-probability threats can have outsized consequences.
Exploit Maturity
Active Exploitation: CVE-2021-22681 is confirmed as actively exploited. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on March 5, 2026, with a federal remediation deadline of March 26, 2026. The vulnerability has been identified as a target for nation-state and advanced persistent threat groups with interest in industrial control system compromise.
Ransomware Association: While CVE-2021-22681 is primarily associated with ICS-targeted attacks rather than traditional ransomware, the ability to halt industrial processes provides significant extortion leverage. Threat actors targeting operational technology environments have used similar controller access vulnerabilities to demand ransom in exchange for restoring normal operations.
Public Exploits: Technical details regarding the key extraction process and authentication bypass have been discussed in ICS security research publications and conference presentations. While full weaponized exploits are not widely distributed in public repositories, the knowledge required to exploit this vulnerability is accessible to sophisticated threat actors.
EPSS Context: The EPSS score of 0.180 (18.0th percentile) indicates above-average exploitation probability. While lower than some IT-focused vulnerabilities, this score is significant in the ICS domain where the potential physical consequences of exploitation amplify the overall risk.
KEV Deadline: The CISA remediation deadline is March 26, 2026. Organizations using affected Rockwell Automation controllers in production environments must prioritize applying vendor-recommended mitigations.
Remediation
-
Apply Rockwell Automation security patches and firmware updates. Follow Rockwell Automation's security advisories to update Studio 5000 Logix Designer, RSLogix 5000, and all affected controller firmware to versions that address the authentication bypass. Consult the Rockwell Automation Product Compatibility and Download Center for the latest available updates.
-
Implement CIP Security on supported controllers. For controller hardware that supports it, enable CIP Security (EtherNet/IP with TLS), which provides certificate-based authentication that is not vulnerable to the key extraction attack. This is the most effective long-term mitigation.
-
Restrict network access to controllers. Implement network segmentation to isolate programmable logic controllers from the enterprise network and the internet. Use industrial firewalls and demilitarized zones (DMZ) to strictly control which systems can communicate with controllers on CIP (Common Industrial Protocol) ports.
-
Deploy application whitelisting on engineering workstations. Prevent unauthorized software from running on workstations that have Studio 5000 or RSLogix 5000 installed. This reduces the risk of key extraction by malware or unauthorized tools.
-
Monitor controller communication for anomalies. Deploy industrial intrusion detection systems (IDS) capable of inspecting CIP traffic for unauthorized connection attempts, logic modifications, or firmware changes. Alert on any controller programming activity outside of authorized maintenance windows.
-
Implement a controller change management program. Establish processes to regularly verify controller logic integrity by comparing running programs against known-good baselines. Any unauthorized changes should trigger an immediate investigation and incident response.
Technical Details
CVE-2021-22681 is a credential protection vulnerability in the authentication mechanism used between Rockwell Automation engineering software (Studio 5000 Logix Designer V21+ and RSLogix 5000 V16-V20) and Logix controller families. The engineering software uses a shared cryptographic key to establish a verification handshake with controllers during programming and monitoring sessions.
The fundamental weakness is that this verification key is not adequately protected within the engineering software. An attacker who can access the engineering workstation (physically or remotely) or capture network traffic between the workstation and controller can extract the key material. With this key, the attacker can construct valid authentication messages that the controller accepts, effectively impersonating a legitimate engineering workstation.
The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates that once the key is obtained, exploitation is straightforward and can be performed over the network without additional privileges or user interaction. The affected controller families include CompactLogix (compact form factor for machine control), ControlLogix (high-performance process control), DriveLogix (integrated drive controllers), GuardLogix (safety-rated controllers), and SoftLogix (PC-based soft controllers).
The vulnerability is particularly concerning because the same key mechanism is used across all these controller families, meaning a single key extraction gives an attacker access to a wide range of industrial control systems. The shared key design represents a systemic architectural weakness rather than a simple implementation bug, which is why remediation requires migrating to certificate-based authentication (CIP Security) rather than simply updating the key.
Frequently Asked Questions
What is CVE-2021-22681?
CVE-2021-22681 is a critical vulnerability in Rockwell Automation's Studio 5000 Logix Designer and RSLogix 5000 engineering software. These tools use a cryptographic key to verify communication with Logix programmable logic controllers. The key is insufficiently protected, allowing an attacker to extract it and use it to bypass authentication and gain full access to CompactLogix, ControlLogix, DriveLogix, GuardLogix, and SoftLogix controllers.
Which Rockwell Automation products are affected?
The vulnerability affects Studio 5000 Logix Designer versions V21 and later, RSLogix 5000 versions V16 through V20, and the controller families they program: CompactLogix 1768, 1769, 5370, 5380, and 5480 series; ControlLogix 5560, 5570, and 5580 series; DriveLogix 5560 and 5730 series; GuardLogix 5560, 5570, 5380, and 5580 series; and SoftLogix 5800 series.
How do I fix CVE-2021-22681?
Apply the latest firmware updates from Rockwell Automation for all affected controllers and engineering software. For the most robust protection, enable CIP Security on controllers that support it, which replaces the vulnerable key-based authentication with certificate-based authentication. Additionally, restrict network access to controllers, monitor CIP traffic for unauthorized connections, and implement controller change management processes.
Why is CVE-2021-22681 critical for industrial environments?
This vulnerability allows an attacker to gain full programming access to industrial controllers that manage physical processes. An attacker with this access can modify safety logic, alter process parameters, halt production, or create dangerous operating conditions. The shared key design means that a single compromise affects all controller families. In sectors such as energy, manufacturing, and water treatment, the physical safety consequences of controller compromise can be severe.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.