peter bassill · operator
$ cve CVE-2021-22681 JSON

CVE-2021-22681 KEV

9.8
CRITICAL · CVSS 3.1 · EPSS 63.6% (pctl 99)

Patch first

On CISA KEV — known exploited in the wild, due 2026-03-26.

Description

Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS63.63% — more likely to be exploited than 99% of all CVEs
WeaknessCWE-522
On CISA KEVyes — remediate by 2026-03-26
Public exploitnone known
Published2021-03-03
Last modified2026-06-17

CISA KEV

NameRockwell Multiple Products Insufficient Protected Credentials Vulnerability
Added2026-03-05
Due2026-03-26
Vendor / productRockwell / Multiple Products
Ransomware usenone reported

Affected (20)

VendorProduct
rockwellautomationcompact guardlogix 5370
rockwellautomationcompact guardlogix 5380
rockwellautomationcompactlogix 1768
rockwellautomationcompactlogix 1769
rockwellautomationcompactlogix 5370
rockwellautomationcompactlogix 5380
rockwellautomationcompactlogix 5480
rockwellautomationcontrollogix 5550
rockwellautomationcontrollogix 5560
rockwellautomationcontrollogix 5570
rockwellautomationcontrollogix 5580
rockwellautomationdrivelogix 1794-l34
rockwellautomationdrivelogix 5560
rockwellautomationdrivelogix 5730
rockwellautomationfactorytalk services platform
rockwellautomationguardlogix 5570
rockwellautomationguardlogix 5580
rockwellautomationrslogix 5000
rockwellautomationsoftlogix 5800
rockwellautomationstudio 5000 logix designer

References

→ the Explorer  ·  watch your stack  ·  NVD