CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.
Affected products
rockwellautomation: factorytalk services platform; rockwellautomation: rslogix 5000; rockwellautomation: studio 5000 logix designer; rockwellautomation: compact guardlogix 5370; rockwellautomation: compact guardlogix 5380; rockwellautomation: compactlogix 1768; rockwellautomation: compactlogix 1769; rockwellautomation: compactlogix 5370; rockwellautomation: compactlogix 5380; rockwellautomation: compactlogix 5480; rockwellautomation: controllogix 5550; rockwellautomation: controllogix 5560; rockwellautomation: controllogix 5570; rockwellautomation: controllogix 5580; rockwellautomation: drivelogix 1794-l34
References3
- us-cert.cisa.gov/ics/advisories/icsa-21-056-03 Third Party AdvisoryUS Government Resource
- us-cert.cisa.gov/ics/advisories/icsa-21-056-03 Third Party AdvisoryUS Government Resource
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=… US Government Resource
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 64% percentile: 99 · as of 2 November 2026
- CWE
- CWE-522
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.