CVE-2021-22681

State: Published
Severity: 9.8 Critical
Published: Mar 3, 2021
Updated: Mar 6, 2026
Reserved: Jan 5, 2021

Description

Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-522 Insufficiently Protected Credentials CWE-522

Affected Products

Product	Versions
Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllersn/a	RSLogix 5000 Versions 16 through 20Affected Studio 5000 Logix Designer: Versions 21 and laterAffected CompactLogix 1768, 1769, 5370, 5380, 5480Affected ControlLogix 5550, 5560, 5570, 5580Affected DriveLogix 5560, 5730, 1794-L34Affected Compact GuardLogix 5370, 5380Affected GuardLogix 5570, 5580Affected SoftLogix 5800Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.