Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix cont
Studio 5000 Logix Designer version 21 and later, and RSLogix 5000 versions 16 through 20, are exposed when communicating with affected Logix controllers. No patch exists, so CIP Security is the mitigation.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Rockwell Automation Studio 5000 Logix Designer and RSLogix 5000 engineering software, used to program and communicate with CompactLogix, ControlLogix, GuardLogix, DriveLogix, and SoftLogix controllers, are affected. An unauthenticated attacker could bypass the key-based verification between the software and these controllers, potentially gaining unauthorized access to industrial control systems.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- Record last updated
- CISA remediation deadline
Due date for US federal agencies to patch
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- n/a Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers
RSLogix 5000 Versions 16 through 20, Studio 5000 Logix Designer: Versions 21 and later, CompactLogix 1768, 1769, 5370, 5380, 5480, ControlLogix 5550, 5560, 5570, 5580, DriveLogix 5560, 5730, 1794-L34, Compact GuardLogix 5370, 5380, GuardLogix 5570, 5580, SoftLogix 5800
References 1
us-cert.cisa.gov
Questions about CVE-2021-22681
What does this mean?
The key-based check that Logix controllers use to verify communications can be bypassed. An unauthorized third-party tool could then authenticate with the controller and change its configuration or application code.Source: cisa.gov
Am I affected, and how do I check?
Studio 5000 Logix Designer version 21 and later, and RSLogix 5000 versions 16 through 20, communicating with affected Logix controllers. FactoryTalk Security v2.10 and later is also affected if it is configured and deployed. To check, look at the installed Studio 5000 or RSLogix 5000 version and whether FactoryTalk Security is configured and deployed.Source: cisa.gov
What should I do about it?
No fixed version is listed, so there is no upgrade target. Apply the workaround: use CIP Security (TLS/DTLS secure communications), and add network segmentation and firewall restrictions on TCP 44818.Source: cisa.gov
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-03-05, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data
What if there's no patch?
Rockwell Automation has determined this vulnerability cannot be mitigated with a patch. Use CIP Security (TLS/DTLS secure communications), keep the controller mode switch in Run mode, and apply network segmentation and firewall restrictions on TCP 44818.Source: cisa.gov