CVE-2021-22659: Rockwell MicroLogix 1400 Remote Modbus Buffer Overflow Denial-of-Service

CVE-2021-22659 is a high-severity buffer overflow vulnerability (CWE-120) in how Rockwell Automation's MicroLogix 1400 programmable logic controller firmware parses Modbus packets: a remote, unauthenticated attacker can send a specially crafted Modbus packet that lets them retrieve or modify random register values and overflow an internal buffer, forcing the controller into a denial-of-service fault state in which its FAULT LED flashes red and industrial communications may be lost, and NVD's own Primary analysis scores the flaw CVSS v3.1 8.6 (high).

CVE-2021-22659 (CWE-120, classic buffer overflow) affects Rockwell Automation's MicroLogix 1400 programmable logic controller, a compact PLC widely deployed in small industrial and water/wastewater installations. NVD's description states: "Rockwell Automation MicroLogix 1400 Version 21.6 and below may allow a remote unauthenticated attacker to send a specially crafted Modbus packet allowing the attacker to retrieve or modify random values in the register. If successfully exploited, this may lead to a buffer overflow resulting in a denial-of-service condition. The FAULT LED will flash RED and communications may be lost. Recovery from denial-of-service condition requires the fault to be cleared by the user" (NVD).

CISA's ICS advisory ICSA-21-033-01 credits Parul Sindhwad and Dr. Faruk Kazi of the Center of Excellence in Complex and Nonlinear Dynamical Systems (COE-CNDS) at Veermata Jijabai Technological Institute (VJTI), India, with reporting the issue, and notes that exploitation requires a high skill level with no known public exploit available at publication. Its mitigation guidance recommends disabling Modbus TCP support where it is not required, using firewalls to block unauthorized Modbus TCP traffic, isolating control-system networks from the internet and business networks, and using VPNs for any necessary remote access (CISA ICSA-21-033-01).

NVD has completed its own severity analysis for this CVE: the Primary score (source [email protected]) is CVSS v3.1 8.6 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H, meaning NVD's own analysts rate the confidentiality and integrity impact as low (an attacker can read/modify arbitrary register values) alongside a high availability impact (the resulting fault). A CISA-submitted Secondary score on the same NVD record, by contrast, rates it 7.5 with no confidentiality or integrity impact at all, illustrating how the two independent assessments of the same crafted-packet behaviour can diverge; the 8.6 figure used on this page is NVD's own Primary rating, not the CISA Secondary one (NVD).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.01795 (78.56th percentile) as of 2026-11-07 (CISA KEV, FIRST EPSS).

Rockwell's fix for this CVE is a firmware update beyond version 21.6; operators who cannot immediately patch should disable Modbus TCP if it is not in active use, restrict Modbus TCP traffic at the firewall, and keep MicroLogix 1400 controllers off networks reachable from the internet or the general business network.

• MicroLogix 1400 Version 21.6 and below may allow a remote unauthenticated attacker to send a specially crafted Modbus packet to retrieve or modify random register values, leading to a buffer overflow and denial-of-service condition; the FAULT LED flashes red and communications may be lost until a user clears the fault. — NVD
• Reported by Parul Sindhwad and Dr. Faruk Kazi of COE-CNDS, VJTI, India; exploitation requires a high skill level with no known public exploit at publication; mitigation is disabling Modbus TCP where unneeded, firewalling, network isolation and VPN-only remote access. — CISA ICSA-21-033-01
• NVD's own Primary CVSS v3.1 score is 8.6 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H; a separate CISA-submitted Secondary score on the same record rates it 7.5 with no confidentiality/integrity impact. — NVD
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.01795 (78.56th percentile) as of 2026-11-07. — FIRST EPSS