---
title: "CVE-2021-22681: Rockwell Multiple Products Insufficient Protected Credentials Vulnerability"
url: https://erroneo.us/security/cve/CVE-2021-22681/
description: "CVE-2021-22681 (Rockwell Multiple Products): Exploited in the wild (CISA KEV). Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and…"
type: vulnerability-record
section: "Security Digest"
date_published: 2021-03-03
date_modified: 2026-03-06
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2021-22681"
kev: true
cvss: 9.8
epss: 0.6363
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2021-22681: Rockwell Multiple Products Insufficient Protected Credentials Vulnerability

**Signal:** Exploited: patch now if you run it. CISA has confirmed exploitation in the wild. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Yes, if you run Rockwell Multiple Products. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2026-03-05, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2026-03-26 ; treat that as the outer limit, not the target.
- EPSS 63.6% , percentile 99: FIRST’s model estimates a 63.6% chance of exploitation activity in the next 30 days, higher than 99% of all scored CVEs (very high). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.

## What it is

Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.

## Affected products (CVE record)

- n/a Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers: RSLogix 5000 Versions 16 through 20, Studio 5000 Logix Designer: Versions 21 and later, CompactLogix 1768, 1769, 5370, 5380, 5480, ControlLogix 5550, 5560, 5570, 5580, DriveLogix 5560, 5730, 1794-L34, Compact GuardLogix 5370, 5380, GuardLogix 5570, 5580, SoftLogix 5800

## Severity

- CISA-ADP CVSS 3.1: 9.8 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

## Exploitation

- CISA KEV: added 2026-03-05; federal due date 2026-03-26. Known ransomware use: Unknown.
- CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CISA SSVC assessment: exploitation active , automatable yes , technical impact total .
- FIRST EPSS (model of 2026-10-21): 63.63% probability of exploitation activity in the next 30 days; percentile 99.

## Sources

- [Listed in CISA KEV notes (support.rockwellautomation.com)](https://support.rockwellautomation.com/app/answers/answer_view/a_id/1130301/~/cve-2021-22681%3A-authentication-bypass-vulnerability-found-in-logix-controllers-)
- [CVE.org record CVE-2021-22681](https://www.cve.org/CVERecord?id=CVE-2021-22681)
- [NVD entry CVE-2021-22681](https://nvd.nist.gov/vuln/detail/CVE-2021-22681)
- [CISA Known Exploited Vulnerabilities catalog entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22681)
- [Listed in CISA KEV notes (cisa.gov)](https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03)
- [us-cert.cisa.gov](https://us-cert.cisa.gov/ics/advisories/icsa-21-056-03)

---
Source page: https://erroneo.us/security/cve/CVE-2021-22681/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt