CVE-2021-22681

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 63.63%
EPSS Percentile: 99.21%
CISA KEV: YES — Known Exploited Vulnerability

Description

Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 04-Mar-2021 01:15
Last Modified: 17-Jun-2026 10:37
EPSS Date: 2026-10-30
CWE: CWE-522

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2026-03-05
Remediation Due: 2026-03-26
Known Ransomware Campaign Use: Unknown
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://support.rockwellautomation.com/app/answers/answer_view/a_id/1130301/~/cve-2021-22681%3A-authentication-bypass-vulnerability-found-in-logix-controllers- ; https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03 ; https://nvd.nist.gov/vuln/detail/CVE-2021-22681

Affected Products / Versions

rockwellautomation / factorytalk_services_platform Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 2.10
cpe:2.3:a:rockwellautomation:factorytalk_services_platform:*:*:*:*:*:*:*:*
rockwellautomation / rslogix_5000 Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 16 · through (inclusive) 20
cpe:2.3:a:rockwellautomation:rslogix_5000:*:*:*:*:*:*:*:*
rockwellautomation / studio_5000_logix_designer Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 21.0
cpe:2.3:a:rockwellautomation:studio_5000_logix_designer:*:*:*:*:*:*:*:*

References

Last enrichment sync: 31-Oct-2026 03:25
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (4)

The company recently confirmed the in-the-wild exploitation of an old vulnerability tracked as CVE-2021-22681. Rockwell Automation Patches Vulnerabilities in ICS Products
issued guidance to strengthen the security of their operational technology deployments: PN1550 | CVE-2021-22681: Authentication Bypass Vulnerability Found in Logix Controllers, published in 2021, and SD1771 | U.S. Agencies Warn of Iranian-Affiliated Actors Exploiting PLCs Across Critical Infrastructure
agencies link the activity to IRGC-associated APTs that have exploited CVE-2021-22681 and urge removing OT devices from direct internet exposure and checking logs for suspicious traffic. U.S. Agencies Warn of Iran-Linked Attacks on Internet-Facing OT
CISA expanded its KEV catalog with legacy and actively exploited vulnerabilities (e.g., CVE-2021-22681, CVE-2017-7921), underscoring persistent real-world exploitation. Cyble Tracks 1,641 Vulnerabilities, Including Critical IT and ICS Flaws

CVE (10)

People (1)

Threat Actors (7)

MITRE ATT&CK (9)

Vendors (13)

Products (20)

Tools (2)

Industries (6)

Countries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.