AEGLIX investigation
CVE-2021-22681 research
A source-linked research view connecting vulnerability evidence, reviewed campaign mentions, retained reporting and security tool listings.
Evidence summary
Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580;...
Known exploitation: prioritize review
- CISA KEV lists real-world exploitation.
CVSS: 9.8 · EPSS: 63.63% (2026-10-28)
Source retrieved 2026-10-29T15:19:43.610019+00:00. Read the full record and affected versions before making a patch decision.
Campaign content mentioning this CVE
Only published campaigns that passed the existing source-review gate are included. A textual mention does not establish exploitation or campaign membership.
No exact mention was found in the checked published campaign content.
Stored reporting mentioning this CVE
These are publisher excerpts, not independent verification of their claims.
No exact mention was found in the checked stored news excerpts.
Investigate advisory publishers
These domains come from vulnerability references. They are advisory publishers, not identified threat indicators. Links prefill Investigate; you choose whether to run a lookup.
- us-cert.cisa.gov
- www.cisa.gov
Find referenced tools in Arsenal
Search published listings whose documented CVE-reference field contains CVE-2021-22681. An empty result is valid. A reference does not establish safety, exploit reliability or suitability for your environment.
Search exact CVE references in Arsenal
Review the listing’s source and trust evidence. Use testing tools only on systems you are authorized to assess.
Coverage and interpretation
Exact CVE mentions in stored public excerpts and reviewed campaign content only. A mention is not proof of exploitation, attribution or tool suitability. Missing matches do not establish absence.
Checked up to 100 candidate excerpts and 100 candidate campaigns; at most 10 results per section are shown. No external search or scan ran while loading this page.