CVE-2021-22681: Rockwell Logix Controller Key Bypass

CVE-2021-22681 is an insufficiently protected credentials flaw in Rockwell Automation's Logix Designer and RSLogix 5000 engineering software: the key used to verify that a Logix controller is talking to legitimate Rockwell design software can be discovered, letting an unauthorized application connect to CompactLogix, ControlLogix, GuardLogix, DriveLogix and SoftLogix 5800 controllers without authentication, and CISA added it to the KEV catalog in 2026 even though the CVE itself dates to 2021.

CVE-2021-22681 (CWE-522, insufficiently protected credentials) affects Rockwell Automation Studio 5000 Logix Designer v21 and later, RSLogix 5000 v16 through v20, and FactoryTalk Services Platform v2.10 and later. These tools use a key to authenticate their communication with Logix controllers; the key can be discovered, which lets an unauthorized application bypass the check and establish a connection to the controller. Exploitation requires only network access to the controller, not valid credentials (NVD).

NVD's own analysis scores the flaw CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD). CISA's ICS-CERT advisory for the same CVE calculated a higher score, CVSS v3 10.0, using a scope-changed vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — a CISA-computed figure rather than NVD's own, reflecting that the flaw can affect resources beyond the directly vulnerable component (CISA ICS Advisory ICSA-21-056-03).

Rockwell's own PSIRT page for this CVE sits behind a customer support login and could not be independently fetched; the facts below are instead sourced to CISA's ICS advisory, which covers the same CVE. The advisory lists the controller families that rely on this trust mechanism as affected: CompactLogix 1768/1769/5370/5380/5480, ControlLogix 5550/5560/5570/5580, DriveLogix 5560/5730/1794-L34, Compact GuardLogix 5370/5380, GuardLogix 5570/5580, and SoftLogix 5800. CISA states the vulnerability "cannot be patched" and recommends a defense-in-depth approach instead: deploy CIP Security for TLS/DTLS-secured controller communication, restrict TCP port 44818 traffic from outside the industrial control network, segment OT networks with firewalls, place ControlLogix controllers in "Run" mode where operationally possible, and monitor controller change logs for unauthorized modifications. As of the advisory, "no known public exploits specifically target this vulnerability" (CISA ICS Advisory ICSA-21-056-03).

CISA added CVE-2021-22681 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-03-05, with a required-action due date of 2026-03-26 — more than five years after the CVE was first published — and the catalog records known ransomware campaign use as "Unknown" (CISA KEV).

As of 2026-10-20, FIRST scores the probability of exploitation at 0.6363 (99.213th percentile) — high despite the "no known public exploits" note in the 2021 ICS advisory, consistent with a credential-bypass flaw in widely deployed PLC engineering software that has drawn renewed attention since its KEV addition (FIRST EPSS).

Because there is no patch, any Logix controller reachable without CIP Security and network segmentation should be treated as exposed to unauthorized connections, and the mitigations above should be verified rather than assumed in place.

• The key used to verify that Logix controllers are communicating with legitimate Rockwell design software (Studio 5000 Logix Designer v21+, RSLogix 5000 v16-20, FactoryTalk Services Platform v2.10+) can be discovered, letting an unauthorized application bypass authentication and connect to the controller with only network access. — NVD
• NVD CVSS v3.1 base score is 9.8 (critical), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; CISA's ICS-CERT advisory separately calculated CVSS v3 10.0 with a scope-changed vector S:C — a CISA-computed figure, not NVD's own. — NVD
• Affected controller families (CompactLogix, ControlLogix, DriveLogix, Compact GuardLogix, GuardLogix, SoftLogix 5800); the flaw cannot be patched; recommended mitigations are CIP Security, restricting TCP 44818, network segmentation, Run-mode placement, and change-log monitoring; as of the advisory no known public exploits target this CVE. — CISA ICS Advisory ICSA-21-056-03
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-03-05, due date 2026-03-26, with ransomware campaign use recorded as Unknown. — CISA KEV
• EPSS score is 0.6363 (99.213th percentile) as of 2026-10-20. — FIRST EPSS