Authentication Bypass in Rockwell Automation Logix Controllers

CVE-2021-22681 is a critical authentication bypass / insufficiently protected credentials issue affecting Rockwell Automation Studio 5000 Logix Designer versions 21 and later, RSLogix 5000 versions 16 through 20, and communications with multiple Logix controller families, including CompactLogix, ControlLogix, GuardLogix, DriveLogix, and SoftLogix. The vulnerable design uses a key to verify that Logix controllers are communicating with trusted Rockwell engineering software. That key can be discovered or extracted, allowing an unauthenticated attacker to bypass the verification mechanism and authenticate to affected controllers as though they were an authorized workstation or application. Rockwell and CISA reporting indicate the flaw enables unauthorized applications to establish accepted connections to controllers without valid credentials once the verification key is obtained.