Skip to main content
Apexward Pulse

Apple

Rockwell Multiple Products Insufficient Protected Credentials Vulnerability

CVE-2021-22681

What this means

This is rated critical severity (9.8 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Rockwellautomation Factorytalk Services Platform, Rockwellautomation Rslogix 5000 and Rockwellautomation Studio 5000 Logix Designer, and 17 more are in your estate, and treat that as the priority.

Full vendor description

Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.

Scoring and exploitation

9.8/ 10
CVSS 3.1 base scoreCritical

Exploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality, integrity and availability.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability

Longer bar: easier to attack

Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredNonePR:N
User interactionNoneUI:N
ScopeUnchangedS:U

Impact

Longer bar: more harm

ConfidentialityHighC:H
IntegrityHighI:H
AvailabilityHighA:H
Elevated attack likelihood (~63.6% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
Exploited in the wild
Yes — confirmed exploitation (US CISA )
Not reported
Listed product
Rockwell Multiple Products

Weaknesses

CWE-522

Affected products ()

  • Rockwellautomation Factorytalk Services Platform
  • Rockwellautomation Rslogix 5000
  • Rockwellautomation Studio 5000 Logix Designer
  • Rockwellautomation Compact Guardlogix 5370
  • Rockwellautomation Compact Guardlogix 5380
  • Rockwellautomation Compactlogix 1768
  • Rockwellautomation Compactlogix 1769
  • Rockwellautomation Compactlogix 5370
  • Rockwellautomation Compactlogix 5380
  • Rockwellautomation Compactlogix 5480
  • Rockwellautomation Controllogix 5550
  • Rockwellautomation Controllogix 5560
  • Rockwellautomation Controllogix 5570
  • Rockwellautomation Controllogix 5580
  • Rockwellautomation Drivelogix 1794 l34
  • Rockwellautomation Drivelogix 5560
  • Rockwellautomation Drivelogix 5730
  • Rockwellautomation Guardlogix 5570
  • Rockwellautomation Guardlogix 5580
  • Rockwellautomation Softlogix 5800
Show the raw CPE strings (20)
  • cpe:2.3:a:rockwellautomation:factorytalk_services_platform:*:*:*:*:*:*:*:*
  • cpe:2.3:a:rockwellautomation:rslogix_5000:*:*:*:*:*:*:*:*
  • cpe:2.3:a:rockwellautomation:studio_5000_logix_designer:*:*:*:*:*:*:*:*
  • cpe:2.3:h:rockwellautomation:compact_guardlogix_5370:-:*:*:*:*:*:*:*
  • cpe:2.3:h:rockwellautomation:compact_guardlogix_5380:-:*:*:*:*:*:*:*
  • cpe:2.3:h:rockwellautomation:compactlogix_1768:-:*:*:*:*:*:*:*
  • cpe:2.3:h:rockwellautomation:compactlogix_1769:-:*:*:*:*:*:*:*
  • cpe:2.3:h:rockwellautomation:compactlogix_5370:-:*:*:*:*:*:*:*
  • cpe:2.3:h:rockwellautomation:compactlogix_5380:-:*:*:*:*:*:*:*
  • cpe:2.3:h:rockwellautomation:compactlogix_5480:-:*:*:*:*:*:*:*
  • cpe:2.3:h:rockwellautomation:controllogix_5550:-:*:*:*:*:*:*:*
  • cpe:2.3:h:rockwellautomation:controllogix_5560:-:*:*:*:*:*:*:*
  • cpe:2.3:h:rockwellautomation:controllogix_5570:-:*:*:*:*:*:*:*
  • cpe:2.3:h:rockwellautomation:controllogix_5580:-:*:*:*:*:*:*:*
  • cpe:2.3:h:rockwellautomation:drivelogix_1794-l34:-:*:*:*:*:*:*:*
  • cpe:2.3:h:rockwellautomation:drivelogix_5560:-:*:*:*:*:*:*:*
  • cpe:2.3:h:rockwellautomation:drivelogix_5730:-:*:*:*:*:*:*:*
  • cpe:2.3:h:rockwellautomation:guardlogix_5570:-:*:*:*:*:*:*:*
  • cpe:2.3:h:rockwellautomation:guardlogix_5580:-:*:*:*:*:*:*:*
  • cpe:2.3:h:rockwellautomation:softlogix_5800:-:*:*:*:*:*:*:*

References

3 links from the CVE record, grouped by site.

Related feed events

  • Rockwell Multiple Products Insufficient Protected Credentials Vulnerability

    Type Vulnerability

    Studio 5000 Logix Designer software may allow a key to be discovered. Known-exploited catalogue reports exploitation in the wild.

    Next step: Confirm whether Apple Multiple Products is in your estate.

    Who's reporting

    1 of 3 perspectives

    Official authority: Official 1Vendor statement missing. no VendorResearcher coverage missing. no Researcher1 signal

    Only official coverage so far. Treat as an early signal.

    Apple Multiple Products
    CVE-2021-22681