{"id":"rockwell-logix-authentication-bypass-mar-2026","category":"patch","status":"closed","title":"Rockwell Logix controller flaw CVE-2021-22681 used in attacks; no patch available","tldr":"A flaw in Rockwell’s industrial controllers lets attackers with network access bypass checks and change controller settings or programs. CISA confirmed exploitation in March 2026. There is no patch: operators must apply Rockwell’s protective controls.","summary":"CVE-2021-22681 affects Rockwell’s Logix industrial controllers and the software used to program them. An inadequately protected key can let an attacker who can reach a controller bypass verification and change its configuration or program. Disclosed in February 2021, the flaw was added to CISA’s exploited-vulnerability catalogue on 5 March 2026. Rockwell’s latest advisory remains dated 10 March and says no patch can address it. Protection depends on measures such as CIP Security, model-specific physical Run-switch settings and network isolation. Tenable later associated the flaw with Iranian-affiliated controller attacks, while acknowledging that CISA’s campaign advisory did not identify a specific exploited CVE. As at 3 November 2026, there is no vendor patch or reported resolution of the underlying flaw.","action":"Nothing for you to do on household devices: these are industrial control systems. If your family owns or runs a business using them, ask its control-systems team to apply Rockwell advisory PN1550, remove direct internet access and implement the model-specific CIP Security or physical Run-switch protections.","product":"Rockwell Automation Logix industrial controllers, RSLogix 5000 and Studio 5000 Logix Designer","audience":"work","severity":"critical","patch":"none","exploited":true,"cves":["CVE-2021-22681"],"tags":["rockwell","logix","industrial-control","authentication-bypass","exploited"],"affected":["RSLogix 5000 v16–20","Studio 5000 Logix Designer v21 and later, and corresponding Logix controllers running these versions","FactoryTalk Security within FactoryTalk Services Platform v2.10 and later, if configured and deployed","1768 CompactLogix; 1769 CompactLogix; CompactLogix 5370, 5380 and 5480","ControlLogix 5550, 5560, 5570, 5580 and 5590","DriveLogix 5730; FlexLogix 1794-L34","Compact GuardLogix 5370 and 5380; GuardLogix 5560, 5570 and 5580","SoftLogix 5800"],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"PN1550: Authentication Bypass Vulnerability Found in Logix Controllers","url":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html","by":"Rockwell Automation","date":"2026-03-10"},{"kind":"news","title":"Rockwell Vulnerability Allowing Remote ICS Hacking Exploited in Attacks","url":"https://www.securityweek.com/rockwell-vulnerability-allowing-remote-ics-hacking-exploited-in-attacks/amp/","by":"SecurityWeek","date":"2026-03-06"},{"kind":"news","title":"Hikvision and Rockwell Automation CVSS 9.8 Flaws Added to CISA KEV Catalog","url":"https://thehackernews.com/2026/03/hikvision-and-rockwell-automation-cvss.html","by":"The Hacker News","date":"2026-03-06"},{"kind":"research","title":"Coordinated cyberattack on U.S. water utilities: What you need to know","url":"https://www.tenable.com/blog/coordinated-cyberattack-on-minnesota-water-utilities-what-you-need-to-know","by":"Tenable","date":"2026-08-10"}],"started":"2026-03-05","closed":"2026-08-10","created":"2026-11-03T22:28:20.557Z","updated":"2026-11-03T22:28:20.557Z","cve_notes":[{"cve":"CVE-2021-22681","name":"Authentication bypass in Rockwell Logix controllers","what":"An inadequately protected verification key in Rockwell’s engineering software can let an attacker with network access authenticate to Logix controllers and change their configuration or programs.","severity":"critical","cvss":10}],"timeline":[{"at":"2026-08-10","added":"2026-11-03T22:23:50.754Z","kind":"other","text":"Tenable’s updated review associated this flaw with Iranian-affiliated industrial-controller attacks. It also noted that CISA’s campaign advisory did not identify a specific exploited CVE, so that campaign link remains a research attribution.","url":"https://www.tenable.com/blog/coordinated-cyberattack-on-minnesota-water-utilities-what-you-need-to-know","by":"Tenable","patch":null},{"at":"2026-03-10","added":"2026-11-03T22:23:50.754Z","kind":"vendor-revised","text":"Rockwell revised its explanation and model-specific protections. It still marked the flaw uncorrected and said it could not be addressed with a patch.","url":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html","by":"Rockwell Automation","patch":"none"},{"at":"2026-03-05","added":"2026-11-03T22:23:50.754Z","kind":"cisa-added","text":"CISA added CVE-2021-22681 to its Known Exploited Vulnerabilities catalogue, with a 26 March deadline for US federal civilian agencies to address it. Rockwell also acknowledged exploitation.","url":"https://www.securityweek.com/rockwell-vulnerability-allowing-remote-ics-hacking-exploited-in-attacks/amp/","by":"SecurityWeek","patch":null},{"at":"2021-05-05","added":"2026-11-03T22:23:50.754Z","kind":"vendor-revised","text":"Rockwell added the 1783-CSP CIP Security Proxy as a protection option for CompactLogix installations. This was a hardware mitigation, not a patch.","url":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html","by":"Rockwell Automation","patch":null},{"at":"2021-02-25","added":"2026-11-03T22:23:50.754Z","kind":"disclosed","text":"Rockwell first disclosed CVE-2021-22681, an authentication weakness affecting Logix controllers and their engineering software.","url":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html","by":"Rockwell Automation","patch":"none"}],"url":"https://hard.fyi/live/rockwell-logix-authentication-bypass-mar-2026/","json":"https://hard.fyi/api/live?id=rockwell-logix-authentication-bypass-mar-2026"}