CVE-2021-22681: Rockwell Logix Designer authentication bypass via weak key verification

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, full confidentiality/integrity/availability impact, and confirmed inclusion in CISA's KEV catalog.

What it is

Rockwell Automation Studio 5000 Logix Designer (v21+) and RSLogix 5000 (v16-20) rely on a key to verify that Logix controllers are talking to genuine Rockwell software. An unauthenticated attacker can bypass that verification mechanism and authenticate to a wide range of CompactLogix, ControlLogix, DriveLogix, GuardLogix and SoftLogix controllers. Because the flaw defeats the trust check between engineering software and controllers, it undermines the integrity of industrial control programming and is listed in CISA's KEV catalog.

Impact

An attacker gains authenticated access to affected Logix controllers, enabling unauthorized reads and writes to controller logic and configuration with high confidentiality, integrity and availability impact. In an ICS environment this can translate to process manipulation or disruption.

Attack surface

Reachable over the network (CVSS vector AV:N) with no privileges and no user interaction required; the attacker only needs network access to the controller or engineering workstation path. No authentication is needed because the bypass is the authentication check itself.

Exploitation

CISA added this CVE to the Known Exploited Vulnerabilities catalog with a remediation due date of 2026-03-26, indicating known exploitation in the wild. EPSS gives a 30-day exploitation probability of roughly 0.64 (99th percentile), and no ransomware campaign use is documented.

What to do

• Apply the vendor mitigations in CISA ICS advisory ICSA-21-056-03 and upgrade Studio 5000 Logix Designer and RSLogix 5000 to fixed versions.
• Follow BOD 22-01 guidance; if mitigations are unavailable, discontinue use of the affected product.
• Segment and firewall Logix controllers so only trusted engineering workstations can reach them, and block controller access from untrusted networks.
• Restrict and monitor engineering workstation access, and enforce least privilege for anyone who can program controllers.
• Review controller key/credential handling and rotate any exposed keys where the vendor supports it.

Detection

• Monitor network traffic to Logix controllers for unexpected or unauthorized engineering connections and authentication attempts.
• Alert on controller program downloads, key changes or logic modifications outside approved change windows.
• Audit engineering workstation logs for Studio 5000 or RSLogix 5000 sessions originating from unexpected hosts or accounts.
• Correlate controller access events with asset inventory to flag connections from non-engineering or non-allowlisted systems.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.