What is CVE-2021-22681?
Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.
The record classifies CVE-2021-22681 under weakness class CWE-522. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs no prior authentication, needs no user interaction, and has high impact on confidentiality, integrity, availability. 20 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 2066 days ago.
Severity and exploitation probability
- CVSS v3.1 base score
- 9.8 — CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS (FIRST)
- 63.6% probability of exploitation in the next 30 days, higher than 99.2% of all scored CVEs
- CISA KEV
- Listed since 2026-03-05, federal remediation deadline 2026-03-26
- Threadlinqs priority
- 9/10 — CISA KEV-listed, which Threadlinqs floors at 9
- Published
- 2021-03-03, last modified 2026-03-06
Is CVE-2021-22681 being exploited?
CISA added CVE-2021-22681 to the Known Exploited Vulnerabilities catalog on 2026-03-05, which means the agency holds evidence of exploitation in the wild; US federal civilian agencies had to remediate it by 2026-03-26 under BOD 22-01. Weaponised exploit code for CVE-2021-22681 is publicly available. 2 public proof-of-concept repositories are tracked for this identifier. It currently carries a trending score of 53 in the Threadlinqs vulnerability feed.
- pcrosby-1990/cip-security-poc (github)
- trickest/cve (trickest)
Affected products and versions
- Rockwellautomation: Factorytalk Services Platform, Rslogix 5000, Studio 5000 Logix Designer, Compact Guardlogix 5370, Compact Guardlogix 5380, Compactlogix 1768, Compactlogix 1769, Compactlogix 5370, Compactlogix 5380, Compactlogix 5480, Controllogix 5550, Controllogix 5560, Controllogix 5570, Controllogix 5580, Drivelogix 1794-l34, Drivelogix 5560, Drivelogix 5730, Guardlogix 5570, Guardlogix 5580, Softlogix 5800
How to fix CVE-2021-22681
The record marks a vendor fix as available for CVE-2021-22681. Patch reference: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1130709. Because CVE-2021-22681 is KEV-listed, US federal civilian agencies were required to apply the vendor fix, or stop using the product, by 2026-03-26. Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.
Threat activity tracking CVE-2021-22681
7 tracked threats in the Threadlinqs corpus reference CVE-2021-22681, either in the campaign’s CVE list or as an indicator on the campaign record.
- Energy & Utilities Cyber Exposure: Ransomware Loss Concentration (Resilience Report) and July 2026 Internet-Exposed PLC Attacks on US Water Utilities (Rockwell MicroLogix) — HIGH · 2026-10-24
- OT Attacks on US Critical Infrastructure: Volt Typhoon Persistence and Iranian-Affiliated PLC Exploitation (Rockwell, Unitronics, Siemens S7) — CRITICAL · 2026-10-06
- AI-Powered Attacks Targeting Siemens S7 Series PLCs in U.S. Critical Infrastructure — CRITICAL · 2026-08-19
- Iran-Linked CyberAv3ngers (BAUXITE) Exploiting Internet-Exposed Rockwell, Schneider Electric, and Siemens PLCs Across US Water, Energy, and Government Infrastructure (CISA AA26-097A) — CRITICAL · 2026-07-25
- NCSC CEO Richard Horne: Hostile States Linked to Three-Quarters of Cyber Attacks on UK Critical National Infrastructure — MEDIUM · 2026-06-17
- Iranian IRGC CyberAv3ngers APT Campaign Targeting Rockwell/Allen-Bradley PLCs (CISA AA26-097A) — CRITICAL · 2026-04-08
- CISA KEV: Hikvision Camera Auth Bypass (CVE-2017-7921) & Rockwell Logix Credential Exposure (CVE-2021-22681) — Active Exploitation — CRITICAL · 2026-03-06
Sources
Enriched from CVE.org, FIRST EPSS, CISA KEV, GitHub Security Advisories, public proof-of-concept repositories. Last verified by Threadlinqs on .