Rockwell Multiple Products Insufficient Protected Credentials Vulnerability

Rockwell Multiple Products

Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controllers are communicating with Rockwell Automation design software. If successfully exploited, this vulnerability could allow an unauthorized application to connect with Logix controllers. To leverage this vulnerability, an unauthorized user would require network access to the controller. Added to CISA KEV on 2026-03-05 (federal deadline 2026-03-26).

First seen: 5 Mar 2026
Last update: 5 Mar 2026, 12:00 UTC
Identifiers: CVE-2021-22681
Source: CISA KEV

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
Severity: high, exploited in the wild. Patch status: patched.
Affected: Rockwell Multiple Products
Ids: CVE-2021-22681

Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controllers are communicating with Rockwell Automation design software. If successfully exploited, this vulnerability could allow an unauthorized application to connect with Logix controllers. To leverage this vulnerability, an unauthorized user would require network access to the controller. Added to CISA KEV on 2026-03-05 (federal deadline 2026-03-26).

## Steps
1. Search the repo, its CI and infra config for Rockwell Multiple Products. If present, report the version in use and whether it's affected.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2021-22681") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2021-22681 https://support.rockwellautomation.com/app/answers/answer_view/a_id/1130301/~/cve-2021-22681%3A-authentication-bypass-vulnerability-found-in-logix-controllers- https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03
https://pwned.coffee/i/rockwell-multiple-products-insufficient-protected-creden-cve-2021-22681

Sources

Totalone hot coffee