{"id":"CVE-2021-22681","kind":"vulnerability","aliases":["CVE-2021-22681"],"related":[],"title":"Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a…","description":"Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.","summary":"Rockwell Studio 5000 Logix Designer may let an attacker discover a key used to verify that Logix controllers talk only to Rockwell design software. With that key, an unauthorized application can connect to Logix controllers.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-03-05T00:00:00+00:00","products":[{"name":"Rockwell Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"rockwellautomation factorytalk services platform","fixed":[],"affected":">= 2.10","ecosystem":"vendor"},{"name":"rockwellautomation rslogix 5000","fixed":[],"affected":">= 16, <= 20","ecosystem":"vendor"},{"name":"rockwellautomation studio 5000 logix designer","fixed":[],"affected":">= 21.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","industrial-control","infrastructure","logix-controllers","rockwell","studio-5000"],"not_affected_if":["isolated-network","no-logix-controllers"],"how_to_check":null,"fix":"Apply mitigations per the vendor instructions referenced by CISA, or discontinue use of the affected product if mitigations are unavailable.","status":"open","published_at":"2021-03-03T18:15:14+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:39:13+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T20:39:13Z","model":"claude-haiku-5-5","output":{"fix":"Apply mitigations per the vendor instructions referenced by CISA, or discontinue use of the affected product if mitigations are unavailable.","reach":"network","summary":"Rockwell Studio 5000 Logix Designer may let an attacker discover a key used to verify that Logix controllers talk only to Rockwell design software. With that key, an unauthorized application can connect to Logix controllers.","category":"infrastructure","who_cares":["rockwell","studio-5000","logix-controllers","industrial-control"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthorized applications can connect to and control Logix industrial controllers.","analyst_note":"Find Rockwell's advisory for CVE-2021-22681 and confirm affected versions, fixed versions and the vendor mitigation steps; the KEV entry gives no product versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-logix-controllers","isolated-network"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000452,"input_tokens":2634,"output_tokens":377,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':20A,23A '-22681':21A,24A '-5000':50B '16':15A,100C,154C '1768':116C,174C '1769':117C,175C '1794':129C,187C '20':17A,102C,156C '21':8A,93C,147C '5000':4A,13A,34A,37A,53B,89C,98C,143C,152C '5370':118C,133C,176C,191C '5380':119C,134C,177C,192C '5480':120C,178C '5550':122C,180C '5560':123C,127C,181C,185C '5570':124C,136C,182C,194C '5580':125C,137C,183C,195C '5730':128C,186C '5800':139C,197C 'applic':80B 'attack':59B,162C 'authent':169C 'autom':2A,87C,114C,141C,172C 'bypass':164C 'communic':111C 'compact':131C,189C 'compactlogix':115C,173C 'connect':82B 'control':43B,47B,68B,85B,109C 'controllogix':121C,179C 'could':163C 'cve':19A,22A 'design':6A,55B,73B,91C,145C 'designer':39A 'discov':60B 'drivelogix':126C,184C 'exploit':40B 'factorytalk':29A 'guardlogix':132C,135C,190C,193C 'industri':42B 'industrial-control':41B 'infrastructur':44B 'key':62B,77B,105C 'l34':130C,188C 'later':10A,95C,149C 'let':57B 'logix':5A,38A,46B,54B,67B,84B,90C,108C,144C 'logix-control':45B 'may':56B 'mechan':167C 'multiple':26A 'platform':31A 'products':27A 'rockwel':1A,48B,51B,72B,86C,113C,140C,171C 'rockwell':25A 'rockwellautomation':28A,32A,35A 'rslogix':12A,33A,97C,151C 'services':30A 'softlogix':138C,196C 'softwar':74B 'studio':3A,36A,49B,52B,88C,142C 'talk':69B 'unauthent':161C 'unauthor':79B 'use':18A,63B,103C 'verif':166C 'verifi':65B,107C 'version':7A,14A,92C,99C,146C,153C 'vulner':158C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-03-03T18:15:14+00:00","kev":{"dateAdded":"2026-03-05","dueDate":"2026-03-26","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-22681","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22681","severity":null,"published_at":"2026-03-05T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:04+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-22681","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22681","severity":null,"published_at":"2021-03-03T18:15:14+00:00","modified_at":"2026-06-17T03:37:34+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}