Rockwell Automation Studio 5000 Logix Designer Versions 21 and later

CVE-2021-22681 is an authentication bypass rooted in the design of Rockwell Automation's Studio 5000 Logix Designer (v21+) and RSLogix 5000 (v16–20). The software uses a single, insufficiently protected cryptographic key to verify that an engineering workstation is authorized to communicate with Logix controllers (CompactLogix, ControlLogix, DriveLogix, FlexLogix, GuardLogix, Compact GuardLogix, SoftLogix 5800). An unauthenticated attacker who recovers this key — which is embedded in every copy of the engineering software — can impersonate a legitimate workstation over the network and connect to any reachable controller to upload malicious ladder logic, download project files, or reflash firmware. The flaw affects virtually every Logix controller in the field.

Rockwell's own CVSS of 9.8 is, if anything, conservative — CISA's ICS-CERT originally scored it 10.0. There is no vendor patch. Rockwell has stated the vulnerability cannot be fixed with a software update because the flaw is architectural: the shared secret is inherent to the CIP authentication protocol used across the product line. The only real mitigation is enabling CIP Security (TLS/DTLS), which requires compatible firmware and hardware that many installed controllers do not support. In 2026, IRGC-affiliated CyberAv3ngers confirmed the threat is not theoretical — they exploited CVE-2021-22681 to breach 30+ Minnesota water utilities, forcing manual operation and causing documented financial losses. This is a live, weaponized, unpatchable vulnerability in safety-critical infrastructure.

Why this verdict

• KEV-listed with active nation-state exploitation: CISA added CVE-2021-22681 to KEV on March 5, 2026 following confirmed exploitation by IRGC-affiliated CyberAv3ngers. The July 2026 Minnesota water attack (30+ utilities) demonstrates ongoing, escalating campaigns.
• Role multiplier — OT/ICS/SCADA controllers governing physical processes: The affected component is a PLC — the canonical high-value OT asset. 100% of Logix controllers occupy this role by definition. Successful exploitation yields control over physical processes: water treatment, power generation, manufacturing. Blast radius is operational/safety-scale. Per the high-value-role floor rule, the verdict floor is CRITICAL.
• Unpatchable architectural flaw: Rockwell has explicitly stated no patch is possible. The shared cryptographic key is baked into the CIP authentication protocol. This means the vulnerability window is permanent for any controller that cannot run CIP Security, which excludes a large portion of the installed base.
• Low attack complexity, no authentication required: CVSS vector confirms AV:N/AC:L/PR:N/UI:N. The attacker needs only network reachability and the extracted key (which has been independently discovered by three research groups). CyberAv3ngers used legitimate Rockwell software — no custom exploit code needed.
• Significant internet-exposed population: ~5,219 directly internet-exposed Rockwell hosts (3,891 in the US) provide unauthenticated remote access to attackers. Thousands more are reachable via poorly segmented OT networks.

Why not higher?

This is already scored at the maximum. CVSS 10.0 and CRITICAL represent the ceiling. There is no higher category.

Why not lower?

Downgrading is indefensible. The vulnerability is unpatchable, actively exploited by a nation-state APT, KEV-listed, affects safety-critical infrastructure, has a massive exposed population, and the affected component (PLC) is by definition a high-value-role asset where compromise equals physical process control. Every friction point that might normally justify a downgrade — 'requires OT network access', 'CIP Security mitigates' — is empirically negated by the Minnesota water attacks, which succeeded against 30+ facilities despite these theoretical mitigations.

1. Immediately remove all Logix controllers from internet-facing networks — The single highest-impact action. 5,219 controllers are internet-exposed globally. Disconnect them or place behind a firewall/VPN that blocks TCP/44818 from untrusted sources. Per the noisgate mitigation SLA for CRITICAL findings, this must be completed within 3 days.
2. Enable CIP Security (TLS/DTLS) on all controllers with compatible firmware — CIP Security is the only protocol-level defense that blocks the authentication bypass. This requires ControlLogix v31+ or CompactLogix v31+ firmware and compatible hardware. Audit your controller inventory and upgrade firmware where possible. Deploy within 3 days for internet-exposed controllers; within 30 days for internally-reachable controllers.
3. Set controller mode switch to RUN via hardware keyswitch — When the physical keyswitch is in RUN, remote program changes are blocked even if an attacker authenticates. This prevents logic upload/modification but not project download or reconnaissance. Coordinate with operations to schedule the switch — leave in REM/PROG only during planned maintenance windows.
4. Enforce strict IT/OT network segmentation with allowlisted engineering stations — Deploy industrial firewalls or DMZ architectures that restrict CIP traffic (TCP/44818, UDP/2222) to explicitly allowlisted engineering workstations by MAC and IP. Deny all other sources. Use unidirectional security gateways (data diodes) where feasible.
5. Deploy OT-native network monitoring (Claroty, Dragos, Nozomi) — These platforms detect anomalous engineering connections to PLCs, unauthorized program changes, and firmware modifications. They provide the only reliable detection layer for this attack path since standard IT EDR has no OT protocol visibility.
6. Implement enhanced logging of all CIP engineering sessions — Log all connections to TCP/44818 with source IP, timestamp, and session duration. Forward to SIEM. Alert on any engineering session originating from non-allowlisted IPs or occurring outside maintenance windows.

Run this script from an engineering workstation or auditor laptop with network access to your Logix controllers. It checks whether CIP Security is enabled on a target controller by attempting an unauthenticated EtherNet/IP identity request. Usage: python3 check_cve_2021_22681.py <controller_ip>. No special privileges required — it performs a standard CIP List Identity request.

#!/usr/bin/env python3
"""CVE-2021-22681 Exposure Check
Checks if a Rockwell Logix controller responds to unauthenticated CIP
List Identity requests on TCP/44818, indicating CIP Security is NOT
enforced and the controller is vulnerable to auth bypass.

Usage: python3 check_cve_2021_22681.py <controller_ip>
Output: VULNERABLE / PATCHED / UNKNOWN
Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN
"""
import socket
import sys
import struct

def check_controller(ip, port=44818, timeout=5):
    # EtherNet/IP List Identity request (encapsulation header)
    # Command: 0x0063 (List Identity), Length: 0, Session: 0
    list_identity = struct.pack('<HHIHIQQ', 0x0063, 0, 0, 0, 0, 0, 0)
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(timeout)
        sock.connect((ip, port))
        sock.sendall(list_identity)
        resp = sock.recv(4096)
        sock.close()
        if len(resp) >= 4:
            cmd = struct.unpack('<H', resp[0:2])[0]
            if cmd == 0x0063:
                # Controller responded to unauthenticated List Identity
                # Parse product name if possible
                product_name = 'Unknown'
                try:
                    if len(resp) > 48:
                        name_len = resp[47]
                        if 48 + name_len <= len(resp):
                            product_name = resp[48:48+name_len].decode('ascii', errors='replace').strip()
                except Exception:
                    pass
                print(f'VULNERABLE - Controller at {ip} responds to unauthenticated CIP requests')
                print(f'Product: {product_name}')
                print(f'CIP Security does NOT appear to be enforced.')
                print(f'This controller is exposed to CVE-2021-22681.')
                return 1  # VULNERABLE
            else:
                print(f'UNKNOWN - Unexpected response command: 0x{cmd:04x}')
                return 2
        else:
            print(f'UNKNOWN - Response too short ({len(resp)} bytes)')
            return 2
    except socket.timeout:
        print(f'UNKNOWN - Connection to {ip}:{port} timed out')
        print('Controller may be unreachable or port filtered.')
        return 2
    except ConnectionRefusedError:
        print(f'PATCHED - Port {port} refused on {ip}')
        print('CIP/EtherNet/IP service not accessible (may indicate CIP Security or firewall).')
        return 0
    except Exception as e:
        print(f'UNKNOWN - Error: {e}')
        return 2

if __name__ == '__main__':
    if len(sys.argv) != 2:
        print(f'Usage: {sys.argv[0]} <controller_ip>')
        sys.exit(2)
    rc = check_controller(sys.argv[1])
    sys.exit(rc)

Sources

1. CISA ICS Advisory ICSA-21-056-03 (Rockwell Logix Controllers)
2. CISA Joint Advisory AA26-097A — CyberAv3ngers
3. SecurityWeek — Rockwell Vulnerability Exploited in Attacks
4. Claroty Team82 — Critical Authentication Bypass in Rockwell Software
5. Kaspersky ICS-CERT — KLCERT-17-029
6. NVD — CVE-2021-22681
7. The Hacker News — Hikvision and Rockwell CVSS 9.8 Flaws Added to KEV
8. TechTimes — Iranian Hackers Breach 30 Minnesota Water Systems