CVE-2021-22681criticalunder attackCWE-522

CVE-2021-22681: critical vulnerability in Rockwell Automation Studio 5000 Logix…

Published · Updated

Follow this CVE+ Monitor Studio 5000 Logix Designer+ Monitor RSLogix

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

70Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.8epss 64%
from disclosure to weapon
Published on NVDMar 3
CISA KEV+1828d
victimsJul 28
Appeared in 1 incident(s) we investigated
Sistemas municipais de água e esgoto do Minnesota (30+ comunidades)
Action required by CISAfederal deadline: 2026-03-26

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Rockwell Automation Studio 5000 Logix Designer and RSLogix 5000 have a flaw that allows attackers to bypass authentication with industrial controllers without needing valid credentials. This is critical because it lets unauthorized users access and control industrial equipment, potentially disrupting operations or causing damage.

Technical detail

An unauthenticated remote attacker can bypass the cryptographic verification mechanism that validates communication between the affected Logix Designer/RSLogix software and multiple Rockwell controller models (CompactLogix, ControlLogix, DriveLogix, GuardLogix, SoftLogix series). The vulnerability enables unauthorized authentication and full administrative access to industrial control systems without requiring knowledge of legitimate credentials.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers