Team82 Discovers Critical Authentication Bypass in Rockwell Software

Claroty (with independent discoverers) reported a critical vulnerability (CVE-2021-22681, CVSS 10.0) in Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000 and many Logix controllers that can allow an attacker to extract a secret cryptographic key and remotely authenticate to PLCs, enabling upload/download of logic, firmware changes, or data theft. The advisory lists affected product families and versions, recommends mitigations such as deploying CIP Security, network segmentation, secure remote access, and controller monitoring features, and provides guidance for detecting unauthorized configuration changes.