Insufficiently protected credentials in Rockwell Automation Studio 5000 Logix Designer…
Priority CRITICAL 100Exploited in the wildCWE-522Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-522.
Summary
Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.
Why it matters now
Exploitation Active In CISA KEV since 2026-03-05CISA due date 2026-03-26
EPSS 0.6363 99th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers | RSLogix 5000 Versions 16 through 20; Studio 5000 Logix Designer: Versions 21 and later; CompactLogix 1768, 1769, 5370, 5380, 5480; ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800 | — | No fix listed | CNA |
- Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers Vendor— Affected RSLogix 5000 Versions 16 through 20; Studio 5000 Logix Designer: Versions 21 and later; CompactLogix 1768, 1769, 5370, 5380, 5480; ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800 Fixed in — No fix listed CNA
CPE configurations NVD · 20
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:rockwellautomation:factorytalk_services_platform:*:*:*:*:*:*:*:* | 2.10 | Vulnerable | Rockwell |
| cpe:2.3:a:rockwellautomation:rslogix_5000:*:*:*:*:*:*:*:* | 16 – 20 | Vulnerable | Rockwell |
| cpe:2.3:a:rockwellautomation:studio_5000_logix_designer:*:*:*:*:*:*:*:* | 21.0 | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:compact_guardlogix_5370:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:h:rockwellautomation:compact_guardlogix_5380:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:h:rockwellautomation:compactlogix_1768:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:h:rockwellautomation:compactlogix_1769:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:h:rockwellautomation:compactlogix_5370:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:h:rockwellautomation:compactlogix_5380:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:h:rockwellautomation:compactlogix_5480:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
- cpe:2.3:a:rockwellautomation:factorytalk_services_platform:*:*:*:*:*:*:*:* Versions 2.10 Vulnerable ·Rockwell
- cpe:2.3:a:rockwellautomation:rslogix_5000:*:*:*:*:*:*:*:* Versions 16 – 20 Vulnerable ·Rockwell
- cpe:2.3:a:rockwellautomation:studio_5000_logix_designer:*:*:*:*:*:*:*:* Versions 21.0 Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:compact_guardlogix_5370:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:h:rockwellautomation:compact_guardlogix_5380:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:h:rockwellautomation:compactlogix_1768:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:h:rockwellautomation:compactlogix_1769:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:h:rockwellautomation:compactlogix_5370:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:h:rockwellautomation:compactlogix_5380:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:h:rockwellautomation:compactlogix_5480:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
Show 10 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:rockwellautomation:controllogix_5550:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:h:rockwellautomation:controllogix_5560:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:h:rockwellautomation:controllogix_5570:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:h:rockwellautomation:controllogix_5580:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:h:rockwellautomation:drivelogix_1794-l34:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:h:rockwellautomation:drivelogix_5560:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:h:rockwellautomation:drivelogix_5730:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:h:rockwellautomation:guardlogix_5570:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:h:rockwellautomation:guardlogix_5580:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:h:rockwellautomation:softlogix_5800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
- cpe:2.3:h:rockwellautomation:controllogix_5550:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:h:rockwellautomation:controllogix_5560:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:h:rockwellautomation:controllogix_5570:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:h:rockwellautomation:controllogix_5580:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:h:rockwellautomation:drivelogix_1794-l34:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:h:rockwellautomation:drivelogix_5560:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:h:rockwellautomation:drivelogix_5730:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:h:rockwellautomation:guardlogix_5570:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:h:rockwellautomation:guardlogix_5580:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:h:rockwellautomation:softlogix_5800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-03-05 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2021-22681
- 2026-10-03 Alias added: GHSA-pvh9-p4pw-h78q
References
More Rockwell Factorytalk Services Platform vulnerabilities
- TI-2024-14577 Rockwell Automation FactoryTalk® Service Platform Service Token Vulnerability CVSS 3.1CRITICAL 9.8
- TI-2020-11367 In Rockwell Automation FactoryTalk Services Platform Versions 6.10.00 and 6.11.00, there… CVSS 3.1CRITICAL 10.0
- TI-2020-05615 Deserialization of untrusted data in Rockwell Automation All versions of FactoryTalk… CVSS 3.1CRITICAL 9.8
- TI-2023-24910 Rockwell Automation FactoryTalk Services Platform Elevated Privileges Vulnerability CVSS 3.1HIGH 8.1
- TI-2021-12569 Rockwell Automation FactoryTalk Services Platform Protection Mechanism Failure CVSS 3.1HIGH 8.8
- TI-2024-14575 Rockwell Automation FactoryTalk® Service Platform Elevated Privileges Vulnerability Through Web Service Functionality CVSS 3.1CRITICAL 9.0
Sources
- CVE-2021-22681 · CVE Program
- CVE-2021-22681 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-pvh9-p4pw-h78q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences