Skip to content
Cyber Threat
CTI Academy Sponsor CTI Academy
CRITICAL · CVSS 9.8 CISA Known Exploited Vulnerability

CVE-2021-22681

Rockwell Multiple Products Insufficient Protected Credentials Vulnerability

Rockwell Multiple Products

Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.

CVSS
9.8
CRITICAL
EPSS
63.6%
30-day exploitation
Ransomware groups
0
recorded exploiting
Published
3 Mar 2021
CWE-522

Exploitation status

CISA Known Exploited Vulnerabilities

Listed by CISA on 5 March 2026. US federal agencies were required to remediate it by 26 March 2026.

EPSS — exploitation probability

FIRST puts the probability of exploitation activity in the next 30 days at 63.6%, which is higher than 99.2% of all scored vulnerabilities. EPSS is a forecast of activity, not a measure of severity, and it is rescored daily.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Frequently asked questions

Is CVE-2021-22681 being exploited by ransomware groups?

No ransomware group in this database is currently recorded as exploiting CVE-2021-22681.

What does CVE-2021-22681 affect?

CVE-2021-22681 affects Rockwell Multiple Products. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.

How severe is CVE-2021-22681?

CVE-2021-22681 is rated CRITICAL with a CVSS base score of 9.8. EPSS puts the probability of exploitation in the next 30 days at 63.6%, higher than 99.2% of all scored vulnerabilities. It is listed in the CISA Known Exploited Vulnerabilities catalog, with a federal remediation deadline of 26 March 2026.

How should organisations respond to CVE-2021-22681?

Apply the vendor patch for Rockwell Multiple Products as the first priority, and treat any internet-facing instance as the most urgent. Because this vulnerability is associated with ransomware activity, also review whether the affected systems were reachable before patching, rather than assuming that patching alone closes the incident.