Actively exploited · Published Mar 3, 2021 · Assigned by icscert

CVE-2021-22681

Critical 9.8 Exploited

In plain English

A critical-severity security flaw in Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers. Attackers are actively exploiting it in the wild (listed by CISA on March 5, 2026). The chance it is exploited in the next 30 days is estimated at 63.6% (higher than 99.2% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)63.6%top 0.8% of all CVEs

Exploited in the wildYesCISA KEV since Mar 5, 2026

Attack tooling1Public PoC

CISA guidance

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by Mar 26, 2026.

Official description

Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.

Affected products (as reported)

Vendor	Product	Versions
n/a	Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers	RSLogix 5000 Versions 16 through 20Studio 5000 Logix Designer: Versions 21 and laterCompactLogix 1768, 1769, 5370, 5380, 5480ControlLogix 5550, 5560, 5570, 5580DriveLogix 5560, 5730, 1794-L34Compact GuardLogix 5370, 5380GuardLogix 5570, 5580SoftLogix 5800

Weakness: CWE-522 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://us-cert.cisa.gov/ics/advisories/icsa-21-056-03 x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22681 government-resource