CVE · Exploited · On CISA KEV

CVE-2021-22681

Rockwell Multiple Products Insufficient Protected Credentials Vulnerability

9.8: CVSS 3.1
1: story
MAR 5: added to KEV

Severity: 9.8 Critical · NVD score
Vendor: Rockwell
Product: Multiple Products
Published: Mar 3, 2021
Added to KEV: Mar 5, 2026
KEV deadline: Mar 26, 2026
Ransomware use: Unknown
Weakness: CWE-522

What it is

Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controllers are communicating with Rockwell Automation design software. If successfully exploited, this vulnerability could allow an unauthorized application to connect with Logix controllers. To leverage this vulnerability, an unauthorized user would require network access to the controller.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑

APR 7
PolicyUS Gov: Iran-Linked Actors Targeting Critical Infrastructure PLCsThe advisory comes amid the ongoing conflict between the U.S. and Iran. CISA said Iran-linked APT campaigns targeting U.S. orgs have recently escalated.LINDSEY O'DONNELL-WELCH · 2 MIN

Official references

3 sources

Registries

RegistryNVDScore, weakness and every reference RegistryCVE.orgThe official CVE record RegistryCISA KEVKnown exploited, with the federal deadline