CVE-2021-22681

What it actually does

The vulnerability is an authentication/verification bypass in Rockwell Automation Studio 5000 Logix Designer versions 21 and later and RSLogix 5000 versions 16 through 20 when communicating with multiple Logix-family controllers. The software relies on a verification key mechanism intended to confirm legitimate Logix controller communication; an unauthenticated network attacker can bypass that mechanism and authenticate to affected CompactLogix, ControlLogix, DriveLogix, GuardLogix, and SoftLogix controllers. Because the issue is remotely reachable, low-complexity, requires no credentials or user interaction, and affects confidentiality, integrity, and availability, successful exploitation can enable unauthorized controller access, logic manipulation, project upload/download activity, or disruption of industrial control operations.

Why it matters to the business

Successful exploitation can let an attacker interact with industrial controllers as though they were trusted engineering software, creating risk of unauthorized process changes, production interruption, safety-system impairment, loss of control visibility, and costly recovery or downtime. This issue is in CISA KEV, has active exploitation observed in the wild, has a high EPSS probability of exploitation, and has a CISA remediation due date of 2026-03-26, so exposed OT assets should be treated as high-priority even though ransomware use is not currently indicated. The provided affected-product metadata lists ChakraCore repositories and a Git commit, which appears inconsistent with the Rockwell control-system description; organizations should verify applicability against Rockwell advisories and asset inventories rather than relying on that package metadata alone.

How an attack unfolds

An attacker first gains network reachability to the control network or to a routable segment exposing EtherNet/IP or other Logix controller communication paths. They identify Rockwell Logix-family controllers and engineering workstations by scanning for industrial-control services, especially EtherNet/IP/CIP traffic commonly associated with TCP port 44818 and UDP port 2222. The attacker then uses the flaw to bypass the expected verification key exchange used by Studio 5000 Logix Designer or RSLogix 5000 when communicating with the controller. Once accepted as an authenticated communication partner, the attacker may query controller identity and status, upload project information, attempt online edits, download modified logic, change controller mode, or disrupt controller communication. In an operational environment, the impact depends on controller role and process design, but could range from reconnaissance and intellectual-property theft to unauthorized control logic changes and loss of production availability.

How to fix it

Apply Rockwell Automation vendor-recommended updates, firmware/software mitigations, and hardening guidance for Studio 5000 Logix Designer, RSLogix 5000, and affected Logix controller families. Prioritize any versions explicitly listed by Rockwell as vulnerable: Studio 5000 Logix Designer versions 21 and later and RSLogix 5000 versions 16 through 20, along with the referenced CompactLogix, ControlLogix, DriveLogix, Compact GuardLogix, GuardLogix, and SoftLogix controller families. Where immediate patching is not possible, isolate controllers from untrusted networks, restrict engineering access to approved jump hosts, block direct Internet access, enforce allow-listed management workstations, restrict EtherNet/IP/CIP traffic to authorized engineering stations, and monitor or block TCP/44818 and UDP/2222 except where operationally required. Use strong remote-access controls, MFA for engineering access paths, change-control approval for online edits/downloads, and controller key-switch or run-mode protections where feasible. The supplied fixed-version metadata lists chakra-core/chakracore and microsoft/chakracore as fixed in commit 428e0474c0cb9423aaa02ea5fb49f1629f97918c; that commit should only be applied if those repositories are actually in scope and should not be considered remediation for the Rockwell Logix vulnerability described here.

How to confirm the fix worked

Confirm exposure by inventorying Rockwell engineering workstations, Studio 5000 Logix Designer versions, RSLogix 5000 versions, and Logix controller models/firmware against the current Rockwell advisory. Validate that vulnerable engineering software versions are upgraded or otherwise remediated, and that any compensating controls are enforced at network boundaries. From a network perspective, verify that only authorized engineering workstations can communicate with controllers over EtherNet/IP/CIP services such as TCP/44818 and UDP/2222. Review firewall rules, switch ACLs, remote-access paths, jump-host policies, and OT monitoring baselines to ensure unauthorized sources cannot initiate controller sessions. Validate operational controls by confirming that controller mode changes, project downloads, and online edits require approved engineering procedures and are logged. If the inconsistent ChakraCore package data is relevant to separate software assets, verify the presence of commit 428e0474c0cb9423aaa02ea5fb49f1629f97918c in those repositories, but treat that as separate from Rockwell controller remediation.

Typical attack path

1. Obtain network access to an OT segment, engineering workstation network, remote-access path, or poorly segmented corporate-to-control network route.
2. Discover Logix-family controllers and Rockwell engineering services using network scanning, passive OT monitoring, or enumeration of EtherNet/IP/CIP traffic.
3. Confirm affected Studio 5000 Logix Designer or RSLogix 5000/controller communication exposure and identify controller families such as CompactLogix, ControlLogix, DriveLogix, GuardLogix, or SoftLogix.
4. Initiate controller communication that mimics legitimate engineering software behavior.
5. Bypass the vulnerable verification mechanism without valid credentials.
6. Authenticate or establish a trusted communication session with the controller.
7. Perform unauthorized actions such as reading controller information, uploading project data, attempting online edits, downloading altered logic, changing mode/state, or disrupting communications.
8. Cover tracks by blending with normal engineering traffic or timing activity during maintenance windows.

How to detect it

Look for evidence of unauthorized engineering-style communication to Logix controllers. Primary sources include OT IDS/NSM telemetry, firewall logs, switch/router flow records, remote-access and jump-host logs, engineering workstation logs, controller audit/event logs, controller project change records, and industrial asset-management/change-control logs. Focus on unexpected sources initiating EtherNet/IP/CIP sessions to controllers, especially TCP/44818 and UDP/2222, connections from corporate IT networks or VPN pools, traffic outside approved maintenance windows, and new engineering workstations communicating with controllers for the first time. Investigate RegisterSession and Forward_Open activity followed by controller upload/download operations, online edits, mode changes, or abnormal reset/fault events. Compare controller projects and checksums against known-good backups and approved change tickets. On engineering workstations, review recent use of Studio 5000 Logix Designer or RSLogix 5000, unusual project file access, unexpected remote logons, new tools capable of speaking CIP/EtherNet/IP, and command histories or scripts that interact with controller services. Because named exploitation details are limited to the KEV-style listing for this Rockwell multiple-products credential protection issue, detection should emphasize behavior: unauthorized controller session establishment, abnormal engineering actions, and configuration drift rather than a single malware indicator.

• TCP/44818
• UDP/2222
• EtherNet/IP
• CIP
• RegisterSession
• Forward_Open
• Studio 5000 Logix Designer
• RSLogix 5000
• Logix Designer
• CompactLogix
• ControlLogix
• DriveLogix
• GuardLogix
• SoftLogix
• controller download
• controller upload
• online edit
• mode change
• Remote Run
• Program Mode
• Run Mode

What your security team should do

• Treat this as a high-priority OT vulnerability because it is KEV-listed, actively exploited in the wild, remotely reachable, unauthenticated, and high-impact.
• Immediately identify all Rockwell Studio 5000 Logix Designer, RSLogix 5000, CompactLogix, ControlLogix, DriveLogix, GuardLogix, and SoftLogix assets and map which are reachable from non-engineering networks.
• Apply Rockwell-recommended updates or mitigations for vulnerable engineering software and controller deployments, prioritizing assets with routable access or critical process roles.
• Restrict TCP/44818, UDP/2222, and other controller-management traffic to approved engineering workstations and OT jump hosts only.
• Review remote-access pathways into OT environments, require MFA, remove persistent vendor access where unnecessary, and log all engineering sessions.
• Hunt for historical unauthorized controller sessions, online edits, downloads, uploads, mode changes, and engineering connections from unusual hosts.
• Enable or tune OT IDS detections for unexpected EtherNet/IP/CIP RegisterSession, Forward_Open, upload/download, and controller mode-change activity.
• Require change-control reconciliation between approved engineering work and controller audit logs to identify unauthorized modifications.
• Back up known-good controller projects and configurations, and verify recovery procedures for critical controllers.
• Do not rely on the supplied ChakraCore fixed commit as Rockwell remediation unless a separate asset assessment confirms ChakraCore is actually affected in the environment.