CVE-2021-44228
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker cont...
Affects 169 products across 19 vendors.
Software does not validate or incorrectly validates input, allowing attackers to craft data processed in unintended ways.
Software does not properly limit resource usage, allowing an attacker to exhaust CPU, memory, disk, or bandwidth.
Software deserializes untrusted data without validation, allowing crafted objects to execute arbitrary code.
Show all 55
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
A critical vulnerability in Apache Log4j2, a widely used logging library, allows attackers to execute arbitrary code on affected systems. This can lead to full system compromise, data exfiltration, and potential disruption of industrial processes. Organizations using Log4j2 in their OT environments are at high risk, especially if the logging library is integrated into critical applications or devices.
BSID: BS-2021-GLOBAL-298547-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2021-44228?
What is the CVSS score for CVE-2021-44228?
Is CVE-2021-44228 actively exploited?
How do I remediate CVE-2021-44228?
What systems are affected by CVE-2021-44228?
What NERC-CIP standard applies to CVE-2021-44228?
What IEC 62443 requirement maps to CVE-2021-44228?
| CVE ID | CVE-2021-44228 |
|---|---|
| BSID | BS-2021-GLOBAL-298547-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| Published | 2021-12-10 |
| Last Modified | 2026-08-11 |
| ICS Relevance | 100% |
| Weakness (CWE) | |
| Verticals | |
| Domains | |
| Source | NVD |
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
Source: NIST NVD / MITRE CVE Database
The vulnerability exists in the JNDI (Java Naming and Directory Interface) feature of Apache Log4j2. An attacker can craft a log message containing a malicious JNDI lookup string, which, when processed by the vulnerable Log4j2 library, triggers a lookup to an attacker-controlled LDAP server. The LDAP server returns a Java class that is then executed on the victim's system. The attacker needs no authentication and can exploit this vulnerability remotely. Post-exploitation, the attacker gains full control of the affected system, potentially leading to data exfiltration, command execution, and disruption of industrial processes. In an OT environment, this could affect engineering workstations, historians, and other critical systems.
Exploitation Likelihood: CRITICAL
| Vendor | Product | Fixed Version |
|---|---|---|
| Apache | Log4J | — |
| Apple | Xcode | — |
| Bentley | Synchro 4D | — |
| Bentley | Synchro | — |
| Cisco | Unified Contact Center Express | — |
| Cisco | Identity Services Engine | — |
| Cisco | Unified Computing System | — |
| Cisco | Unity Connection | — |
| Cisco | Webex Meetings Server | — |
| Cisco | Video Surveillance Operations Manager | — |
| Cisco | Video Surveillance Manager | — |
| Cisco | Finesse | — |
| Cisco | Mobility Services Engine | — |
| Cisco | Ucs Director | — |
| Cisco | Unified Communications Manager Im And Presence Service | — |
| Cisco | Prime Service Catalog | — |
| Cisco | Unified Intelligence Center | — |
| Cisco | Integrated Management Controller Supervisor | — |
| Cisco | Virtual Topology System | — |
| Cisco | Evolved Programmable Network Manager | — |
| Cisco | Fog Director | — |
| Cisco | Firepower Threat Defense | — |
| Cisco | Data Center Network Manager | — |
| Cisco | Fxos | — |
| Cisco | Firepower 9300 | — |
| Cisco | Firepower 2110 | — |
| Cisco | Firepower 2120 | — |
| Cisco | Firepower 2130 | — |
| Cisco | Firepower 2140 | — |
| Cisco | Firepower 4110 | — |
| Cisco | Firepower 4120 | — |
| Cisco | Firepower 4140 | — |
| Cisco | Firepower 4150 | — |
| Cisco | Virtualized Voice Browser | — |
| Cisco | Network Services Orchestrator | — |
| Cisco | Network Assurance Engine | — |
| Cisco | Packaged Contact Center Enterprise | — |
| Cisco | Connected Mobile Experiences | — |
| Cisco | Firepower 4112 | — |
| Cisco | Firepower 4115 | — |
| Cisco | Firepower 4125 | — |
| Cisco | Firepower 4145 | — |
| Cisco | Enterprise Chat And Email | — |
| Cisco | Common Services Platform Collector | — |
| Cisco | Emergency Responder | — |
| Cisco | Firepower 1120 | — |
| Cisco | Firepower 1140 | — |
| Cisco | Dna Spaces\ | — |
| Cisco | Crosswork Network Automation | — |
| Cisco | Firepower 1150 | — |
| Cisco | Sd-Wan Vmanage | — |
| Cisco | Unified Communications Manager Im \& Presence Service | — |
| Cisco | Business Process Automation | — |
| Cisco | Intersight Virtual Appliance | — |
| Cisco | Nexus Insights | — |
| Cisco | Advanced Malware Protection Virtual Private Cloud Appliance | — |
| Cisco | Automated Subsea Tuning | — |
| Cisco | Broadworks | — |
| Cisco | Cloud Connect | — |
| Cisco | Cloudcenter | — |
| Cisco | Cloudcenter Cost Optimizer | — |
| Cisco | Cloudcenter Suite Admin | — |
| Cisco | Cloudcenter Workload Manager | — |
| Cisco | Contact Center Domain Manager | — |
| Cisco | Contact Center Management Portal | — |
| Cisco | Crosswork Data Gateway | — |
| Cisco | Crosswork Network Controller | — |
| Cisco | Crosswork Optimization Engine | — |
| Cisco | Crosswork Platform Infrastructure | — |
| Cisco | Crosswork Zero Touch Provisioning | — |
| Cisco | Customer Experience Cloud Agent | — |
| Cisco | Cyber Vision Sensor Management Extension | — |
| Cisco | Dna Center | — |
| Cisco | Iot Operations Dashboard | — |
| Cisco | Nexus Dashboard | — |
| Cisco | Optical Network Controller | — |
| Cisco | Paging Server | — |
| Cisco | Smart Phy | — |
| Cisco | Ucs Central | — |
| Cisco | Virtualized Infrastructure Manager | — |
| Cisco | Wan Automation Engine | — |
| Cisco | Workload Optimization Manager | — |
| Cisco | Unified Sip Proxy | — |
| Cisco | Unified Workforce Optimization | — |
| Cisco | Cloudcenter Suite | — |
| Cisco | Cx Cloud Agent | — |
| Cisco | Cyber Vision | — |
| Cisco | Dna Spaces | — |
| Cisco | Dna Spaces Connector | — |
| Cisco | Network Dashboard Fabric Controller | — |
| Cisco | Network Insights For Data Center | — |
| Cisco | Ucs Central Software | — |
| Cisco | Unified Contact Center Management Portal | — |
| Cisco | Unified Communications Manager Im & Presence Service | — |
| Cisco | Firepower 1010 | — |
| Cisco | Unified Contact Center Enterprise | — |
| Cisco | Unified Communications Manager | — |
| Cisco | Unified Customer Voice Portal | — |
| Debian | Debian Linux | — |
| Fedoraproject | Fedora | — |
| Honeywell | — | — |
| Intel | Oneapi Sample Browser | — |
| Intel | Secure Device Onboard | — |
| Intel | Computer Vision Annotation Tool | — |
| Intel | Datacenter Manager | — |
| Intel | Genomics Kernel Library | — |
| Intel | System Studio | — |
| Johnsoncontrols | — | — |
| Michael K. Johnson | — | — |
| Netapp | Active Iq Unified Manager | — |
| Netapp | Cloud Insights | — |
| Netapp | Solidfire \& Hci Storage Node | — |
| Netapp | Cloud Secure Agent | — |
| Netapp | Ontap Tools | — |
| Netapp | Cloud Manager | — |
| Netapp | Brocade San Navigator | — |
| Netapp | Solidfire Enterprise Sds | — |
| Netapp | Solidfire & Hci Storage Node | — |
| Netapp | Snapcenter | — |
| Netapp | Oncommand Insight | — |
| Percussion | Rhythmyx | — |
| Rockwell Automation | — | — |
| Schneider | — | — |
| Schneider-Electric | — | — |
| Siemens | Energy Engage | — |
| Siemens | Energyip | — |
| Siemens | Energyip Prepay | — |
| Siemens | Head-End System Universal Device Integration System | — |
| Siemens | Industrial Edge Management Hub | — |
| Siemens | Mindsphere | — |
| Siemens | Navigator | — |
| Siemens | Nx | — |
| Siemens | Sentron Powermanager | — |
| Siemens | Siguard Dsa | — |
| Siemens | Siveillance Command | — |
| Siemens | Siveillance Identity | — |
| Siemens | Siveillance Vantage | — |
| Siemens | Sipass Integrated | — |
| Siemens | Solid Edge Cam Pro | — |
| Siemens | Solid Edge Harness Design | — |
| Siemens | Teamcenter | — |
| Siemens | Vesys | — |
| Siemens | Xpedition Enterprise | — |
| Siemens | Xpedition Package Integrator | — |
| Siemens | Logo! Soft Comfort | — |
| Siemens | Comos | — |
| Siemens | Siveillance Viewpoint | — |
| Siemens | Logo\! Soft Comfort | — |
| Siemens | Spectrum Power 4 | — |
| Siemens | Spectrum Power 7 | — |
| Siemens | Opcenter Intelligence | — |
| Siemens | Mendix | — |
| Siemens | Siveillance Control Pro | — |
| Siemens | Gma-Manager | — |
| Siemens | Operation Scheduler | — |
| Siemens | Industrial Edge Management | — |
| Siemens | 6Bk1602-0Aa12-0Tp0 Firmware | — |
| Siemens | 6Bk1602-0Aa12-0Tp0 | — |
| Siemens | 6Bk1602-0Aa22-0Tp0 Firmware | — |
| Siemens | 6Bk1602-0Aa22-0Tp0 | — |
| Siemens | 6Bk1602-0Aa32-0Tp0 Firmware | — |
| Siemens | 6Bk1602-0Aa32-0Tp0 | — |
| Siemens | 6Bk1602-0Aa42-0Tp0 Firmware | — |
| Siemens | 6Bk1602-0Aa42-0Tp0 | — |
| Siemens | 6Bk1602-0Aa52-0Tp0 Firmware | — |
| Siemens | 6Bk1602-0Aa52-0Tp0 | — |
| Siemens | Sppa-T3000 Ses3000 Firmware | — |
| Siemens | Sppa-T3000 Ses3000 | — |
| Siemens | Capital | — |
| Siemens | Desigo Cc Advanced Reports | — |
| Siemens | Desigo Cc Info Center | — |
| Siemens | E-Car Operation Center | — |
| Snowsoftware | Snow Commander | — |
| Snowsoftware | Vm Access Proxy | — |
| Sonicwall | Email Security | — |
| Wolfram Schneider | — | — |
| CISA KEV | ● Active Exploitation Confirmed (added 2021-12-10) |
|---|---|
| Public Exploit | ⚠ Available — Reference |
| PoC Code | Not confirmed |
Implement strict egress filtering at the perimeter firewall to block outbound LDAP (TCP 389) and RMI (TCP 1099) traffic. Ensure all logging configurations disable JNDI lookups. Apply network segmentation to isolate critical systems from general IT networks. Monitor for unusual outbound connections from affected systems.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
CIP-007-R1 requires the identification and disabling of unnecessary ports and services. The vulnerable JNDI feature in Log4j2 represents an unnecessary service that should be disabled on BES Cyber Assets.
IEC 62443 SR 7.6 (Secure Software Development) is violated. The vulnerability arises from a lack of input validation and secure coding practices in the Log4j2 library, allowing for remote code execution.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-23 |
| SHA-512 Audit Hash | ddd97ebb5517a849bc846026fef8e8027b2910f19ace5f1b0b67ea51d05721e76e57e25cf7a5ae1d65a2d367f581fc588c2ce086c2f5bc9f42ba0ecd96f04af9 |
This Vulnerability Is Being Actively Exploited
CVE-2021-44228 is on the CISA KEV list - confirmed active exploitation in the wild. BreachSpider flags known-exploited CVEs on the ICS assets they affect, with known-exploited status synced daily from CISA.
Create a free account →