CVE-2021-22681

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2021-22681 9.8

Rockwell · Multiple Products · Added 2026-03-05 · Published 2021-03-03

3-Day Required KEV Automatable Active Exploitation

Details

VulnerabilityRockwell Multiple Products Insufficient Protected Credentials Vulnerability

VendorRockwell

ProductMultiple Products

Date added2026-03-05

Due date2026-03-26

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-522

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controllers are communicating with Rockwell Automation design software. If successfully exploited, this vulnerability could allow an unauthorized application to connect with Logix controllers. To leverage this vulnerability, an unauthorized user would require network access to the controller.

NVD: Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation design software. If successfully exploited, this vulnerability could allow an unauthorized application to connect with Logix controllers. To leverage this vulnerability, an unauthorized user would require network access to the controller.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-08-28 14:42 UTC

Searches5

Component defaultyes - the key verification mechanism is active by default in all affected Studio 5000 Logix Designer and RSLogix 5000 versions; CIP Security (the remediation) must be explicitly deployed

Sources https://claroty.com/team82/research/critical-authentication-bypass-in-rockwell-software
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html
https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03
https://www.outlierautomation.com/blog/logix-plc-vulnerability-what-you-need-to-know-and-what-to-do-now
https://arstechnica.com/information-technology/2021/02/hard-coded-key-vulnerability-in-logix-plcs-has-severity-score-of-10-out-of-10/
https://socradar.io/blog/hikvision-camera-rockwell-logix-cisa/

Hunting hypothesis agent

Hunt CIP/EtherNet/IP connections on TCP 44818 from unauthorized hosts sending Forward Open or Unconnected Send to Logix controllers, then cross-reference controller change logs for unexpected program uploads or config changes.

Research details

ComponentHardcoded cryptographic key in Studio 5000 Logix Designer / RSLogix 5000 used for controller verification over EtherNet/IP (CIP over TCP port 44818)

PreconditionsNetwork access to a Rockwell Logix controller on TCP port 44818 (EtherNet/IP); the attacker must extract the hardcoded cryptographic key embedded in Studio 5000 Logix Designer or RSLogix 5000 software; no authentication required. Affected controller families: CompactLogix 1768/1769/5370/5380/5480, ControlLogix 5550/5560/5570/5580/5590, DriveLogix 5560/5730/1794-L34, Compact GuardLogix 5370/5380, GuardLogix 5560/5570/5580, SoftLogix 5800. Affected software: RSLogix 5000 v16-20, Studio 5000 Logix Designer v21+. No software patch exists; mitigation requires CIP Security deployment or physical mode switch to Run. agent

DeliveryNetwork-based exploitation over EtherNet/IP (CIP protocol on TCP port 44818). The attacker extracts the hardcoded cryptographic key from Studio 5000 Logix Designer or RSLogix 5000 software, then uses a custom tool or modified CIP client to establish an authenticated session with the target Logix controller. The key is used to digitally sign all CIP messages, bypassing the controller's verification mechanism. Once authenticated, the attacker can upload ladder logic, modify controller configuration, or download application code, directly affecting the physical industrial process controlled by the PLC.

Public PoCno

Advisoryhttps://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS 9.8). The hardcoded cryptographic key is embedded in the Studio 5000 Logix Designer / RSLogix 5000 binary and is identical across all installations. An attacker who extracts this key from the software can authenticate to any vulnerable Logix controller over EtherNet/IP. The key signs all communication with Rockwell PLCs; the PLCs verify the signature to authorize the connection. With the key, an attacker can mimic an engineering workstation, upload/download malicious ladder logic or configuration, and directly manipulate industrial processes. No public exploit code exists as of August 2026, but the vulnerability has been added to CISA KEV under active exploitation (March 2026) and Iranian-affiliated cyber actors have been observed targeting Logix PLCs. The Claroty Team82 research that discovered this vulnerability described exploitation as requiring low skill level. Mitigation is non-patch: deploy CIP Security (TLS/DTLS-based endpoint authentication), put controllers in physical Run mode, or restrict network access on TCP 44818.

SummaryCVE-2021-22681 is a critical (CVSS 9.8) authentication bypass vulnerability in Rockwell Automation's Studio 5000 Logix Designer and RSLogix 5000 engineering software. A hardcoded cryptographic key used to verify communication between the design software and Logix controllers can be extracted from the software binary. An unauthenticated attacker with network access to a controller on TCP port 44818 can use this key to authenticate as a legitimate engineering workstation, enabling upload of malicious code, modification of controller configuration, and direct manipulation of industrial control processes. No software patch exists; mitigation requires deploying CIP Security, placing controllers in physical Run mode, or strict network segmentation. The vulnerability affects the full range of Rockwell Logix controllers (CompactLogix, ControlLogix, DriveLogix, GuardLogix, SoftLogix) and was added to CISA KEV in March 2026 under active exploitation.

Tia coverage

First reported2026-07-29

First exploit report2026-07-29

Exploit report → KEV146 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

us-water-sector-campaign-now-confirmed-in-12-states-georgia-s-cl

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.