Loading vulnerability…
CVE-2021-22681 is a critical authentication bypass vulnerability affecting Rockwell Automation Studio 5000 Logix Designer version 21 and later, RSLogix 5000 versions 16 through 20, and multiple Logix controller families including CompactLogix, ControlLogix, GuardLogix, DriveLogix, and SoftLogix. The flaw stems from insufficient protection of a cryptographic key used by the engineering software to verify communications with Logix controllers. If an attacker discovers, extracts, intercepts, or otherwise obtains this key, the attacker can bypass the verification mechanism and impersonate legitimate Rockwell engineering software when connecting to affected controllers. Successful exploitation enables unauthorized authentication to the controller without valid operator or engineering credentials and can permit direct interaction with controller project data and programming functions.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small Python proof-of-concept suite, not a weaponized exploit kit. It contains 11 files total: 4 runnable Python scripts, 4 substantive Markdown documents, a requirements file, and licensing/notice files. The code focuses on modeling the security failure behind CVE-2021-22681 and demonstrating a mitigation principle using open tooling rather than vendor hardware. Repository structure and purpose: - `test1_baseline_vulnerable.py`: launches a local `cpppo` EtherNet/IP PLC simulator on `127.0.0.1:44818` and performs anonymous read/write operations against the tag `PumpSpeed_RPM`. Main capability: demonstrates unauthenticated network access and control-tag modification over EtherNet/IP default behavior. - `test2_shared_secret_fails.py`: creates two local TCP services on `127.0.0.1:50001` and `127.0.0.1:50002`, both protected by the same hardcoded key `ROCKWELL-STUDIO5000-UNIVERSAL-KEY-2019`. Main capability: demonstrates the architectural weakness of a fleet-wide shared secret, where a credential valid for one device is valid for another. - `test3_mutual_tls_fix.py`: generates a temporary CA and per-device certificates, then starts three local TLS endpoints on ports 60443/60444/60445. It compares a strict endpoint that enforces SAN-based identity binding against a naive endpoint that only checks CA validity, and also tests reverse-direction server identity validation. Main capability: demonstrates that mutual TLS with per-device identity binding prevents cross-device credential reuse, while CA-validity-only checks do not. - `test4_revocation.py`: generates a CA, endpoint cert, client cert, and CRL, then runs a TLS endpoint on `127.0.0.1:60446` that re-reads the current CRL and denies revoked credentials. Main capability: demonstrates revocation as a necessary lifecycle control beyond uniqueness. The Markdown files (`README.md`, `PHASED_ROLLOUT.md`, `62443-4-2_SL2_MAPPING.md`) provide context, mitigation guidance, and standards mapping. They make clear this is a principle-level PoC for ICS/OT security around Rockwell Logix/CIP Security concepts and CVE-2021-22681, not a verified exploit against real Rockwell hardware. Overall exploit capability assessment: - The repository does contain exploit-like behavior in Test 1 because it performs unauthorized tag modification over a real protocol simulator. - Test 2 is a structural demonstration of credential reuse across devices. - Tests 3 and 4 are mitigation/validation PoCs rather than offensive exploitation. - All network activity is local-only (`127.0.0.1`) and self-contained; there are no external C2s, downloaders, persistence mechanisms, or destructive payloads. In short, this is a credible PoC repository centered on CVE-2021-22681 and related ICS authentication weaknesses. It demonstrates both the vulnerable pattern and a proposed cryptographic remediation model, with the strongest offensive behavior being local simulation of unauthenticated EtherNet/IP tag writes.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
49 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An unauthenticated access vulnerability affecting Rockwell Logix controllers, cited here as a plausible intrusion vector in attacks against water utilities.
A Rockwell Automation/Allen-Bradley controller vulnerability identified in the article as the only one known to be exploited; it is significant because it is in CISA KEV, though the article states it does not affect the MicroLogix controllers involved in the advisory.
A critical authentication bypass in Rockwell Automation Logix controllers that enables unauthenticated access by abusing an insufficiently protected cryptographic key used between Studio 5000 Logix Designer and Logix PLCs. It is significant because the content ties it to confirmed exploitation by Iranian-affiliated actors targeting U.S. critical infrastructure and notes there is no vendor patch.
An older vulnerability explicitly cited as likely weaponized in recent Iran-linked attacks in the US, used here as an example of attackers exploiting long-unpatched external-facing systems.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.