CVE-2021-22681
KEV の『悪用』には未遂(脆弱でない環境やハニーポットでの試行)が含まれ、特定の組織が侵害されたことを意味しない。
KEV の登録内容
- vulnerabilityName
- Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
- vendorProject
- Rockwell
- product
- Multiple Products
- dateAdded
- 2026-03-05
- shortDescription
- Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controllers are communicating with Rockwell Automation design software. If successfully exploited, this vulnerability could allow an unauthorized application to connect with Logix controllers. To leverage this vulnerability, an unauthorized user would require network access to the controller.
- requiredAction
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- dueDate
- 2026-03-26
- knownRansomwareCampaignUse
- Unknown
- forensicTriage
- No
- notes
- https://support.rockwellautomation.com/app/answers/answer_view/a_id/1130301/~/cve-2021-22681%3A-authentication-bypass-vulnerability-found-in-logix-controllers- ; https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03 ; https://nvd.nist.gov/vuln/detail/CVE-2021-22681
- cwes
- CWE-522
観測した変更
取り込み開始以降、KEV の値の変更は観測していません。
CVE レコード(CVE Program)
- state
- PUBLISHED
- datePublished
- dateUpdated
CNA の affected
- n/a Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers
KEV と CNA で製品の表記が異なる。KEV の vendorProject・product と CNA の affected が、大文字小文字を無視した包含で一致しなかった(機械的な照合で、どちらが正しいかは判定していない)。
外部のページ
出典: CISA Known Exploited Vulnerabilities Catalog(CISA KEV。CC0 1.0)。 詳しくは出典表記とライセンス。
出典: CVE Program(CVE レコード)。詳しくは出典表記とライセンス。
Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.