Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
Rockwell Studio 5000 Software Allows Unauthorized Access to Controllers
Known exploited
Exploitation likelihood: 15%
CVE-2021-22681
CVE-2021-22681
Summary
Rockwell's Studio 5000 Logix Designer software has a security issue where an unauthorized user with network access can discover a key that allows them to connect to Rockwell Logix controllers without permission. This could let an unauthorized program control the controllers, which could be a security risk. To stay safe, ensure that network access to the controllers is restricted and only authorized personnel have access to the Studio 5000 software.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| rockwell | multiple products | All versions | – |
| rockwellautomation | factorytalk_services_platform | > 2.10 | – |
| rockwellautomation | rslogix_5000 | > 16 , <= 20 | – |
| rockwellautomation | studio_5000_logix_designer | > 21.0 | – |
Original title
Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
Original description
Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controllers are communicating with Rockwell Automation design software. If successfully exploited, this vulnerability could allow an unauthorized application to connect with Logix controllers. To leverage this vulnerability, an unauthorized user would require network access to the controller.
Vulnerability type
CWE-522
Insufficiently Protected Credentials
- https://us-cert.cisa.gov/ics/advisories/icsa-21-056-03 Third Party Advisory US Government Resource
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-... US Government Resource
Published: 5 Mar 2026 · Updated: 14 Mar 2026 · First seen: 6 Mar 2026