CVE-2021-22681

Description

The Rockwell Automation Compact GuardLogix 5380 controller uses a hardcoded cryptographic key for communication verification. Unauthenticated remote attackers can extract this key to bypass authentication, allowing them to mimic an engineering workstation and manipulate controller logic or configurations.

Description (MITRE) cveawg.mitre.org

Pulled from cveawg.mitre.org/api/cve/CVE-2021-22681 on 2026-06-30. Shown when MITRE's text differs from the cvelistV5 mirror.

Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.

Overview

State

—

Assigner (CNA)

—

CVSS severity

—

CVSS score

—

CVSS vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Effective score

9.8 / 10 CRITICAL source: NVD

CWE(s)

—

Reserved

—

Published

2021-02-25 00:00 UTC

Last updated

—

Source

https://www.rapid7.com/db/vulnerabilities/rockwell-compact-guardlogix-5380-cve-2021-22681/

Linked Threat

CVE-2021-22681 — Rockwell Multiple Products: Rockwell Multiple Products Insufficient Protected Credentials Vulnerability

CISA Known Exploited Vulnerabilities CISA KEV

CISA has confirmed in-the-wild exploitation of this CVE. Federal agencies must remediate by the due date below; private orgs should treat it as priority-1.

Vulnerability name

Rockwell Multiple Products Insufficient Protected Credentials Vulnerability

Vendor / project

Rockwell

Product

Multiple Products

Date added to KEV

2026-03-05

Remediation due

2026-03-26

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Ransomware campaign use

Unknown

CISA notes

https://support.rockwellautomation.com/app/answers/answer_view/a_id/1130301/~/cve-2021-22681%3A-authentication-bypass-vulnerability-found-in-logix-controllers- ; https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03 ; https://nvd.nist.gov/vuln/detail/CVE-2021-22681

CISA listing

www.cisa.gov/known-exploited-vulnerabilities-catalog

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published

2021-03-03 18:15:14 UTC

NVD last modified

2026-06-17 03:37:34 UTC

NVD CVSS v3.1

9.8 / 10 CRITICAL source: nvd@nist.gov

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability subscore

3.9 / 10

Impact subscore

5.9 / 10

EPSS score

0.2545 (probability of exploitation in next 30 days)

EPSS percentile

97.69% vs all CVEs — higher = more likely to be exploited, as of 2026-06-29

NVD-assigned CWE(s): CWE-522 (differs from the CNA list above)

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2021-9817

Assigner

icscert

Published

Mar 3, 2021, 5:59:43 PM

Updated

Mar 6, 2026, 5:01:20 AM

EUVD base score (CVSS 3.1)

9.8 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EUVD-reported EPSS

50.7100

Vendors

n/a

Products

Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers (ControlLogix 5550, 5560, 5570, 5580)

Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers (Compact GuardLogix 5370, 5380)

Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers (RSLogix 5000 Versions 16 through 20)

Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers (SoftLogix 5800)

Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers (Studio 5000 Logix Designer: Versions 21 and later)

Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers (CompactLogix 1768, 1769, 5370, 5380, 5480)

Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers (DriveLogix 5560, 5730, 1794-L34)

Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers (GuardLogix 5570, 5580)

Aliases

GHSA-pvh9-p4pw-h78q

ENISA description: Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (6)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1130301 rapid7:rockwellautomation.custhelp.com
• http://cwe.mitre.org/data/definitions/287.html rapid7:cwe.mitre.org
• https://us-cert.cisa.gov/ics/advisories/icsa-21-056-03 rapid7:us-cert.cisa.gov
• https://attackerkb.com/topics/CVE-2021-22681 rapid7:attackerkb.com
• https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03 rapid7:www.cisa.gov
• https://www.cve.org/CVERecord?id=CVE-2021-22681 rapid7:www.cve.org

Indicators (2)

IOCs linked to the auto-promoted Threat row.

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

• Update Software, Mitigation M1051 - Enterprise | MITRE ATT&CK®
  web:attack.mitre.org

  This mitigation can be implemented through the following measures: Regular Operating System Updates Implementation: Apply the latest Windows security updates monthly using WSUS (Windows Server Update Services) or a similar patch management solution. Configure systems to check for updates automatically and schedule reboots during maintenance ...

  2026-06-04 08:32 UTC
• Security Update Guide - Microsoft
  web:msrc.microsoft.com

  The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

  2026-06-04 08:32 UTC
• NVD - Home
  web:nvd.nist.gov

  The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, product names, and impact metrics. For ...

  2026-06-04 08:32 UTC
• Vulnerability Remediation vs Mitigation: Which Strategy Wins in ...
  web:securityboulevard.com

  Cybersecurity vulnerabilities pose significant risks to organizations in today's digital landscape. Left unaddressed, these vulnerabilities can lead to data breaches, financial losses, and reputational damage. Organizations must decide how to tackle vulnerabilities—through remediation , mitigation , or a combination of both. But which strategy is more effective? This blog explores the ...

  2026-06-04 08:32 UTC
• CISA flags two-year-old Oracle flaw as actively exploited in attacks
  web:www.bleepingcomputer.com

  CISA has ordered government agencies to secure their systems against a high-severity Oracle WebLogic Server vulnerability that was patched two years ago and is now actively exploited in attacks.

  2026-06-04 08:32 UTC
• BOD 22-01: Reducing the Significant Risk of Known Exploited ... - CISA
  web:www.cisa.gov

  This page contains a web-friendly version of the Cybersecurity and Infrastructure Security Agency's Binding Operational Directive 22-01 - Reducing the Significant Risk of Known Exploited Vulnerabilities. A binding operational directive is a compulsory direction to federal, executive branch, departments and agencies for purposes of safeguarding federal information and information systems ...

  2026-06-04 08:32 UTC
• Oracle's first monthly patch release fixes 35 flaws, including 11 rated ...
  web:www.csoonline.com

  Oracle has released the first security fixes in its new monthly Critical Security Patch Update (CSPU) cycle, designed to address urgent vulnerabilities that can't wait for the company's ...

  2026-06-04 08:32 UTC
• Oracle Critical Patch Update Advisory - April 2026
  web:www.oracle.com

  This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

  2026-06-04 08:32 UTC
• Vulnerability Remediation vs. Mitigation: What are the Differences ...
  web:www.secure.com

  Remediation fully removes a vulnerability by fixing its root cause — through a patch , code fix , or system replacement. Mitigation reduces the risk of exploitation without removing the flaw itself, using controls like network segmentation or access restrictions.

  2026-06-04 08:32 UTC
• Oracle Patches 450 Vulnerabilities With April 2026 CPU
  web:www.securityweek.com

  Oracle on Tuesday announced the release of 481 new security patches as part of its April 2026 Critical Patch Update (CPU). Across the 28 product families that received security updates, more than 300 patches address vulnerabilities that are remotely exploitable without authentication. Roughly three dozen fixes resolve critical-severity security defects. There appear to be approximately 450 ...

  2026-06-04 08:32 UTC
• CISA Required Action
  CISA KEV

  Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due date: 2026-03-26 Known ransomware campaign use: Unknown

  2026-05-14 01:13 UTC

Only Available for Registered Users. Sign in to view.