CVE-2021-22681

critical · 9.8Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added 2026-03-05Remediation due 2026-03-26

Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.

9.8

CVSS

63.6%

EPSS (exploit prob.)

99th

EPSS percentile

2021-03-03

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-522

Affected products

Vendor	Product	Affected versions
rockwellautomation	factorytalk_services_platform	>= 2.10
rockwellautomation	rslogix_5000	>= 16, <= 20
rockwellautomation	studio_5000_logix_designer	>= 21.0
rockwellautomation	compact_guardlogix_5370	all versions
rockwellautomation	compact_guardlogix_5380	all versions
rockwellautomation	compactlogix_1768	all versions
rockwellautomation	compactlogix_1769	all versions
rockwellautomation	compactlogix_5370	all versions
rockwellautomation	compactlogix_5380	all versions
rockwellautomation	compactlogix_5480	all versions
rockwellautomation	controllogix_5550	all versions
rockwellautomation	controllogix_5560	all versions
rockwellautomation	controllogix_5570	all versions
rockwellautomation	controllogix_5580	all versions
rockwellautomation	drivelogix_1794-l34	all versions
rockwellautomation	drivelogix_5560	all versions
rockwellautomation	drivelogix_5730	all versions
rockwellautomation	guardlogix_5570	all versions
rockwellautomation	guardlogix_5580	all versions
rockwellautomation	softlogix_5800	all versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2021-22681