CVE-2021-22681 is an insufficiently protected credentials flaw in Rockwell Automation's Logix Designer and RSLogix 5000 engineering software: the key used to verify that a Logix controller is talking to legitimate Rockwell design software can be discovered, letting an unauthorized application connect to CompactLogix, ControlLogix, GuardLogix, DriveLogix and SoftLogix 5800 controllers without authentication, and CISA added it to the KEV catalog in 2026 even though the CVE itself dates to 2021.
Vulnerability summary
CVSS base score
9.8
Critical severity
EPSS score (FIRST)
63.6%
Probability of exploitation in the wild in the next 30 days
CISA KEV catalog
Yes
Listed as known exploited
Published
Vulnerability ID: CVE-2021-22681 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Rockwell Automation Studio 5000 Logix Designer | cpe:2.3:a:rockwellautomation:studio_5000_logix_designer:*:*:*:*:*:*:*:* | 21.0 and later |
| Rockwell Automation RSLogix 5000 | cpe:2.3:a:rockwellautomation:rslogix_5000:*:*:*:*:*:*:*:* | 16 through 20 |
| Rockwell Automation FactoryTalk Services Platform | cpe:2.3:a:rockwellautomation:factorytalk_services_platform:*:*:*:*:*:*:*:* | 2.10 and later |
What does this mean for affected devices?
CVE-2021-22681 (CWE-522, insufficiently protected credentials) affects Rockwell Automation Studio 5000 Logix Designer v21 and later, RSLogix 5000 v16 through v20, and FactoryTalk Services Platform v2.10 and later. These tools use a key to authenticate their communication with Logix controllers; the key can be discovered, which lets an unauthorized application bypass the check and establish a connection to the controller. Exploitation requires only network access to the controller, not valid credentials (NVD).
NVD's own analysis scores the flaw CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD). CISA's ICS-CERT advisory for the same CVE calculated a higher score, CVSS v3 10.0, using a scope-changed vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — a CISA-computed figure rather than NVD's own, reflecting that the flaw can affect resources beyond the directly vulnerable component (CISA ICS Advisory ICSA-21-056-03).
Rockwell's own PSIRT page for this CVE sits behind a customer support login and could not be independently fetched; the facts below are instead sourced to CISA's ICS advisory, which covers the same CVE. The advisory lists the controller families that rely on this trust mechanism as affected: CompactLogix 1768/1769/5370/5380/5480, ControlLogix 5550/5560/5570/5580, DriveLogix 5560/5730/1794-L34, Compact GuardLogix 5370/5380, GuardLogix 5570/5580, and SoftLogix 5800. CISA states the vulnerability "cannot be patched" and recommends a defense-in-depth approach instead: deploy CIP Security for TLS/DTLS-secured controller communication, restrict TCP port 44818 traffic from outside the industrial control network, segment OT networks with firewalls, place ControlLogix controllers in "Run" mode where operationally possible, and monitor controller change logs for unauthorized modifications. As of the advisory, "no known public exploits specifically target this vulnerability" (CISA ICS Advisory ICSA-21-056-03).
CISA added CVE-2021-22681 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-03-05, with a required-action due date of 2026-03-26 — more than five years after the CVE was first published — and the catalog records known ransomware campaign use as "Unknown" (CISA KEV).
As of 2026-10-20, FIRST scores the probability of exploitation at 0.6363 (99.213th percentile) — high despite the "no known public exploits" note in the 2021 ICS advisory, consistent with a credential-bypass flaw in widely deployed PLC engineering software that has drawn renewed attention since its KEV addition (FIRST EPSS).
Because there is no patch, any Logix controller reachable without CIP Security and network segmentation should be treated as exposed to unauthorized connections, and the mitigations above should be verified rather than assumed in place.
Evidence
- The key used to verify that Logix controllers are communicating with legitimate Rockwell design software (Studio 5000 Logix Designer v21+, RSLogix 5000 v16-20, FactoryTalk Services Platform v2.10+) can be discovered, letting an unauthorized application bypass authentication and connect to the controller with only network access. — NVD
- NVD CVSS v3.1 base score is 9.8 (critical), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; CISA's ICS-CERT advisory separately calculated CVSS v3 10.0 with a scope-changed vector S:C — a CISA-computed figure, not NVD's own. — NVD
- Affected controller families (CompactLogix, ControlLogix, DriveLogix, Compact GuardLogix, GuardLogix, SoftLogix 5800); the flaw cannot be patched; recommended mitigations are CIP Security, restricting TCP 44818, network segmentation, Run-mode placement, and change-log monitoring; as of the advisory no known public exploits target this CVE. — CISA ICS Advisory ICSA-21-056-03
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-03-05, due date 2026-03-26, with ransomware campaign use recorded as Unknown. — CISA KEV
- EPSS score is 0.6363 (99.213th percentile) as of 2026-10-20. — FIRST EPSS
Related advisories
Sources
Frequently asked questions
Can CVE-2021-22681 be fixed with a software patch?
No. CISA's ICS advisory states the vulnerability cannot be patched, because the weakness is in how the discoverable authentication key itself works, not a coding bug that a firmware update can remove; CISA instead recommends a defense-in-depth set of mitigations (per CISA ICS Advisory ICSA-21-056-03).
Which Rockwell controller families does this vulnerability actually reach?
CISA's advisory lists CompactLogix 1768/1769/5370/5380/5480, ControlLogix 5550/5560/5570/5580, DriveLogix 5560/5730/1794-L34, Compact GuardLogix 5370/5380, GuardLogix 5570/5580, and SoftLogix 5800 as the controller families that rely on the affected trust mechanism (per CISA ICS Advisory ICSA-21-056-03).
Why do NVD and CISA score CVE-2021-22681 differently?
NVD's own analysis scores it CVSS v3.1 9.8 using an unchanged-scope vector. CISA's ICS-CERT advisory separately calculated a higher CVSS v3 10.0 using a scope-changed vector, reflecting CISA's judgment that the flaw can affect resources beyond the directly vulnerable component — a CISA-computed figure rather than NVD's own (per NVD; per CISA ICS Advisory ICSA-21-056-03).
Was CVE-2021-22681 being actively exploited when CISA's original advisory was published?
No — the 2021 CISA advisory explicitly states that, as of its publication, no known public exploits specifically targeted this vulnerability. CISA nonetheless added it to the Known Exploited Vulnerabilities catalog years later, on 2026-03-05, with a required-action due date of 2026-03-26 (per CISA ICS Advisory ICSA-21-056-03; per CISA KEV).
What mitigations does CISA recommend in place of a patch?
CISA recommends deploying CIP Security for TLS/DTLS-secured controller communication, restricting TCP port 44818 traffic from outside the industrial control network, segmenting OT networks with firewalls, placing ControlLogix controllers in "Run" mode where operationally possible, and monitoring controller change logs for unauthorized modifications (per CISA ICS Advisory ICSA-21-056-03).
Questions about this page?