CVE-2021-22681

CRITICAL(9.8)KEVLikely Exploited

Rockwell Multiple Products Insufficient Protected Credentials Vulnerability

Description

CVE-2021-22681 is a CRITICAL severity vulnerability (CVSS 9.8) involving insufficiently protected credentials (CWE-522) in Rockwell Automation products. Studio 5000 Logix Designer versions V21 and later, as well as RSLogix 5000 versions V16 through V20, use a cryptographic key to verify communication with Logix controllers. An unauthenticated remote attacker who obtains this key can bypass the verification mechanism and authenticate with multiple Rockwell Automation controller product families, including CompactLogix, ControlLogix, DriveLogix, GuardLogix, and SoftLogix. With a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, the vulnerability is exploitable over the network with no authentication or user interaction required. CISA added CVE-2021-22681 to the Known Exploited Vulnerabilities catalog on March 5, 2026, with a remediation deadline of March 26, 2026. The EPSS score of 0.180 (18.0th percentile) indicates meaningful exploitation probability, particularly concerning given the critical role of programmable logic controllers in industrial control systems.

KEV Information

Vendor
Rockwell
Product
Multiple Products
Date Added
March 5, 2026
Due Date
March 26, 2026
Required Action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVSS Score

Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in Calculator
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9

CWEs

Affected Products

VendorProductVersion
rockwellautomationfactorytalk services platform>= 2.10
rockwellautomationrslogix 5000>= 16, <= 20
rockwellautomationstudio 5000 logix designer>= 21.0

Multiple CVSS Assessments

Source: [email protected](Primary)
9.8
CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0(Secondary)
9.8
CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Weakness Type

CWE-522: Insufficiently Protected Credentials

Insufficiently Protected Credentials (CWE-522) is a vulnerability class where a system transmits or stores authentication credentials using methods that do not provide adequate protection against unauthorized access. This weakness can manifest as credentials stored in plaintext, transmitted without encryption, embedded in source code, or protected with insufficient cryptographic mechanisms. When credentials are inadequately protected, attackers can intercept, extract, or reverse-engineer them to gain unauthorized access to systems and resources.

In CVE-2021-22681, the Rockwell Automation Studio 5000 Logix Designer and RSLogix 5000 development environments use a shared cryptographic key to verify the identity of Logix controllers during communication sessions. This key is not sufficiently protected and can be extracted by an attacker who gains access to the engineering workstation software or network traffic. Once in possession of the key, the attacker can impersonate a legitimate engineering workstation and establish authenticated sessions with any of the affected controller families (CompactLogix, ControlLogix, DriveLogix, GuardLogix, SoftLogix), bypassing the authentication mechanism entirely. This grants the attacker the ability to read and modify controller logic, change operating parameters, and disrupt industrial processes.

Impact Analysis

CVE-2021-22681 carries a CVSS 3.1 base score of 9.8 (CRITICAL), reflecting the potential for complete compromise of affected industrial control systems.

Confidentiality (High): An attacker who obtains the verification key gains read access to the controller's programmed logic, configuration parameters, operational data, and process variables. In industrial environments, this information can reveal proprietary manufacturing processes, safety system configurations, and operational details that constitute sensitive intellectual property or could be used to plan more targeted attacks.

Integrity (High): The most dangerous aspect of this vulnerability is the ability to modify controller logic and operating parameters. An attacker with write access to a programmable logic controller can alter process control sequences, change safety thresholds, modify alarm configurations, or inject malicious ladder logic. In safety-critical applications such as chemical processing, power generation, or manufacturing, unauthorized modifications to controller logic can create dangerous physical conditions.

Availability (High): An attacker can disrupt controller operation by halting the processor, clearing program memory, or placing the controller in a fault state. Since Logix controllers typically manage real-time industrial processes, any disruption to controller availability can cause immediate production outages, equipment damage, or safety incidents depending on the application.

Scope (Unchanged): While the vulnerability's direct impact is on the controller systems, the consequences extend to the physical processes they control. The EPSS score of 0.180 indicates notable exploitation interest, which is significant in the ICS context where even low-probability threats can have outsized consequences.

Exploit Maturity

Active Exploitation: CVE-2021-22681 is confirmed as actively exploited. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on March 5, 2026, with a federal remediation deadline of March 26, 2026. The vulnerability has been identified as a target for nation-state and advanced persistent threat groups with interest in industrial control system compromise.

Ransomware Association: While CVE-2021-22681 is primarily associated with ICS-targeted attacks rather than traditional ransomware, the ability to halt industrial processes provides significant extortion leverage. Threat actors targeting operational technology environments have used similar controller access vulnerabilities to demand ransom in exchange for restoring normal operations.

Public Exploits: Technical details regarding the key extraction process and authentication bypass have been discussed in ICS security research publications and conference presentations. While full weaponized exploits are not widely distributed in public repositories, the knowledge required to exploit this vulnerability is accessible to sophisticated threat actors.

EPSS Context: The EPSS score of 0.180 (18.0th percentile) indicates above-average exploitation probability. While lower than some IT-focused vulnerabilities, this score is significant in the ICS domain where the potential physical consequences of exploitation amplify the overall risk.

KEV Deadline: The CISA remediation deadline is March 26, 2026. Organizations using affected Rockwell Automation controllers in production environments must prioritize applying vendor-recommended mitigations.

Remediation

  1. Apply Rockwell Automation security patches and firmware updates. Follow Rockwell Automation's security advisories to update Studio 5000 Logix Designer, RSLogix 5000, and all affected controller firmware to versions that address the authentication bypass. Consult the Rockwell Automation Product Compatibility and Download Center for the latest available updates.

  2. Implement CIP Security on supported controllers. For controller hardware that supports it, enable CIP Security (EtherNet/IP with TLS), which provides certificate-based authentication that is not vulnerable to the key extraction attack. This is the most effective long-term mitigation.

  3. Restrict network access to controllers. Implement network segmentation to isolate programmable logic controllers from the enterprise network and the internet. Use industrial firewalls and demilitarized zones (DMZ) to strictly control which systems can communicate with controllers on CIP (Common Industrial Protocol) ports.

  4. Deploy application whitelisting on engineering workstations. Prevent unauthorized software from running on workstations that have Studio 5000 or RSLogix 5000 installed. This reduces the risk of key extraction by malware or unauthorized tools.

  5. Monitor controller communication for anomalies. Deploy industrial intrusion detection systems (IDS) capable of inspecting CIP traffic for unauthorized connection attempts, logic modifications, or firmware changes. Alert on any controller programming activity outside of authorized maintenance windows.

  6. Implement a controller change management program. Establish processes to regularly verify controller logic integrity by comparing running programs against known-good baselines. Any unauthorized changes should trigger an immediate investigation and incident response.

Technical Details

CVE-2021-22681 is a credential protection vulnerability in the authentication mechanism used between Rockwell Automation engineering software (Studio 5000 Logix Designer V21+ and RSLogix 5000 V16-V20) and Logix controller families. The engineering software uses a shared cryptographic key to establish a verification handshake with controllers during programming and monitoring sessions.

The fundamental weakness is that this verification key is not adequately protected within the engineering software. An attacker who can access the engineering workstation (physically or remotely) or capture network traffic between the workstation and controller can extract the key material. With this key, the attacker can construct valid authentication messages that the controller accepts, effectively impersonating a legitimate engineering workstation.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates that once the key is obtained, exploitation is straightforward and can be performed over the network without additional privileges or user interaction. The affected controller families include CompactLogix (compact form factor for machine control), ControlLogix (high-performance process control), DriveLogix (integrated drive controllers), GuardLogix (safety-rated controllers), and SoftLogix (PC-based soft controllers).

The vulnerability is particularly concerning because the same key mechanism is used across all these controller families, meaning a single key extraction gives an attacker access to a wide range of industrial control systems. The shared key design represents a systemic architectural weakness rather than a simple implementation bug, which is why remediation requires migrating to certificate-based authentication (CIP Security) rather than simply updating the key.

Frequently Asked Questions

What is CVE-2021-22681?

CVE-2021-22681 is a critical vulnerability in Rockwell Automation's Studio 5000 Logix Designer and RSLogix 5000 engineering software. These tools use a cryptographic key to verify communication with Logix programmable logic controllers. The key is insufficiently protected, allowing an attacker to extract it and use it to bypass authentication and gain full access to CompactLogix, ControlLogix, DriveLogix, GuardLogix, and SoftLogix controllers.

Which Rockwell Automation products are affected?

The vulnerability affects Studio 5000 Logix Designer versions V21 and later, RSLogix 5000 versions V16 through V20, and the controller families they program: CompactLogix 1768, 1769, 5370, 5380, and 5480 series; ControlLogix 5560, 5570, and 5580 series; DriveLogix 5560 and 5730 series; GuardLogix 5560, 5570, 5380, and 5580 series; and SoftLogix 5800 series.

How do I fix CVE-2021-22681?

Apply the latest firmware updates from Rockwell Automation for all affected controllers and engineering software. For the most robust protection, enable CIP Security on controllers that support it, which replaces the vulnerable key-based authentication with certificate-based authentication. Additionally, restrict network access to controllers, monitor CIP traffic for unauthorized connections, and implement controller change management processes.

Why is CVE-2021-22681 critical for industrial environments?

This vulnerability allows an attacker to gain full programming access to industrial controllers that manage physical processes. An attacker with this access can modify safety logic, alter process parameters, halt production, or create dangerous operating conditions. The shared key design means that a single compromise affects all controller families. In sectors such as energy, manufacturing, and water treatment, the physical safety consequences of controller compromise can be severe.

CVSS Score

9.8
CRITICAL(9.8)

EPSS Score

EPSS Score60.99%
EPSS Percentile99.1%

Dates

PublishedMarch 3, 2021
Last ModifiedJune 17, 2026
StatusAnalyzed
CVSS Versionv3.1

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.