Skip to content
OpenAdvisories
Critical · 9.8 Known exploited Public exploit CVE-2021-22681 EUVD-2021-9817GHSA-pvh9-p4pw-h78q

Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix con…

Published Mar 3, 2021 · Updated Mar 6, 2026 · Assigned by icscert

Description

Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.

Affected products

VendorProductAffectedFixed
— Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers RSLogix 5000 Versions 16 through 20, Studio 5000 Logix Designer: Versions 21 and later, CompactLogix 1768, 1769, 5370, 5380, 5480, ControlLogix 5550, 5560, 5570, 5580, DriveLogix 5560, 5730, 1794-L34, Compact GuardLogix 5370, 5380, GuardLogix 5570, 5580, SoftLogix 5800 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • pcrosby-1990/cip-security-poc ★ 0 · Jul 31, 2026

    ▎ Open, runnable proof of concept + IEC 62443-4-2 (SL 2) mapping + a phased rollout for CVE-2021-22681 — the unpatchable Rockwell Logix hardcoded-key flaw behind the 2026 water-sector attacks. Reprod…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

References