CVE-2021-22659
No exploitation reported by the sources we read.
- Published2021-03-25
- WeaknessCWE-120
Am I affected?
Debian, Ubuntu or Red Hat sometimes backport a fix without changing the upstream version number: such a version reads « to verify », never « affected ».With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.
Description
Rockwell Automation MicroLogix 1400 Version 21.6 and below may allow a remote unauthenticated attacker to send a specially crafted Modbus packet allowing the attacker to retrieve or modify random values in the register. If successfully exploited, this may lead to a buffer overflow resulting in a denial-of-service condition. The FAULT LED will flash RED and communications may be lost. Recovery from denial-of-service condition requires the fault to be cleared by the user.
Timeline
dates in UTC- 2021-03-2516:15CVE publishedNVD
Observed activity
isMalicious corpus · updated 2026-10-23 21:37 UTCBlock these indicators
- Firewall list (EDL, text): https://api.ismalicious.com/edl/cve/CVE-2021-22659?format=txt
- CSV export: https://api.ismalicious.com/edl/cve/CVE-2021-22659?format=csv
- TAXII collection of exploited CVEs
- The EDL and CSV take an API key on the Pro plan.
Versions per branch
NVD| Branch | Affected | Fixed in | Source |
|---|---|---|---|
| 21.6 | ≤ 21.6 | no fix published | NVD |
as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.
Distribution builds and vendor advisories
Packages from OSV.dev and products from the vendors' CSAF advisories.
version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.
Vendor advisories
Rockwell Automation MicroLogix 1400 (Update A)
MicroLogix 1400 All series: Version 21.6 and below
Fix
- Mitigation from the vendor CISA ICSA-21-033-01 · 1 productAll users, if applicable, may disable Modbus TCP support if it is not necessary for their MicroLogix 1400 implementation. Without Modbus TCP enabled, a potential attacker does not have access to exploit the device using this vulnerability.
- Mitigation from the vendor CISA ICSA-21-033-01 · 1 productFor additional information see Rockwell Automation Security Advisory PN1545.
- Mitigation from the vendor CISA ICSA-21-033-01 · 1 productUtilize proper network infrastructure controls (such as firewalls) to help ensure Modbus TCP from unauthorized sources are blocked.
- Mitigation from the vendor CISA ICSA-21-033-01 · 1 productConsult the product documentation for specific features (such as a hardware keyswitch setting), which may be used to block unauthorized changes, etc.
- Mitigation from the vendor CISA ICSA-21-033-01 · 1 productBlock all traffic to EtherNet/IP or other CIP protocol-based devices from outside the manufacturing zone by blocking or restricting access to TCP and UDP Port 2222 and 44818 using proper network infrastructure controls, such as firewalls, UTM devices, or other security appliances. For more informat…
- Mitigation from the vendor CISA ICSA-21-033-01 · 1 productRun all software as a User, not as an Administrator, to minimize the impact of malicious code on the infected system.
Advisories and patches
- rockwellautomation.custhelp.comVendor Advisory
Detection
- Nuclei template
- none so far ProjectDiscovery
- Exploit-DB
- no entry Exploit-DB
- Proof-of-concept repositories
- none listed PoC-in-GitHub
Sources
Technical details
- CVSS v3 Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
- Published
- 2021-03-25
- Last Modified
- 2026-06-17
- NVD status
- Modified
Frequently asked questions
What is CVE-2021-22659?
Is CVE-2021-22659 actively exploited?
What is the CVSS score for CVE-2021-22659?
Running Rockwell Automation MicroLogix? Hear about its next vulnerability
Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».
No credit card required · No monthly cap on website lookups · 250 API requests/month
Go further
- Following what attackers exploit right now? The CISA KEV additions of the month, with their patch deadlines.
- Running this software? Vulnerability monitoring alerts you to new vulnerabilities in your products.
Related vulnerabilities
Same product first, then the same vendor advisory and the same publication week.