PT-2021-2236 · Rockwell Automation · Rockwell Automation Studio 5000 Logix Designer+7

Published 2021-03-03 · Updated 2026-05-31 · CVE-2021-22681

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rockwell Automation Studio 5000 Logix Designer versions 21 and later, and RSLogix 5000 versions 16 through 20.

Description An authentication bypass issue exists in Rockwell Automation's Studio 5000 Logix Designer and RSLogix 5000 software, affecting CompactLogix 1768, 1769, 5370, 5380, 5480, ControlLogix 5550, 5560, 5570, 5580, DriveLogix 5560, 5730, 1794-L34, Compact GuardLogix 5370, 5380, GuardLogix 5570, 5580, and SoftLogix 5800 controllers. An unauthenticated attacker can bypass verification mechanisms and authenticate with these controllers. This vulnerability, identified as CVE-2021-22681, is actively exploited by Iranian-affiliated threat actors, including CyberAv3ngers, who have moved beyond defacement to manipulating PLC logic in U.S. critical infrastructure sectors like water, energy, and government. The vulnerability stems from a hardcoded authentication key. There is currently no patch available.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BDU:2021-01181

CVE-2021-22681

Affected Products

Compact Guardlogix

Compactlogix

Controllogix

Drivelogix

Guardlogix

Rslogix 5000

Rockwell Automation Studio 5000 Logix Designer

Softlogix

References · 44

• https://osv.dev/vulnerability/CVE-2021-22681 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01181 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-21-056-03 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22681 · Security Note
• https://support.rockwellautomation.com/app/answers/answer_view/a_id/1130301/~/cve-2021-22681%3A-authentication-bypass-vulnerability-found-in-logix-controllers- · Security Note
• https://twitter.com/atolivia/status/2033228210125619566 · Twitter Post
• https://t.me/cveNotify/154495 · Telegram Post
• https://twitter.com/ThreatSynop/status/2029902068014625059 · Twitter Post
• https://twitter.com/Cyber_O51NT/status/2042394257277808772 · Twitter Post
• https://twitter.com/OscarOPS/status/2029980378191020426 · Twitter Post
• https://twitter.com/OT_ISAC/status/2032030184887767544 · Twitter Post
• https://t.me/true_secator/2801 · Telegram Post
• https://twitter.com/TweetThreatNews/status/2041644713904570578 · Twitter Post
• https://twitter.com/ThreatAft/status/2049687370069659726 · Twitter Post
• https://t.me/aptreports/29351 · Telegram Post