CVE-2022-20821
published 2022-05-26CVE-2022-20821: A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running…
PriorityP182medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
KEVITW
CISA Known Exploited Vulnerabilitydue 2022-06-13
Exploited in the wild
EPSS
11.76%
95.6th percentile
A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database. Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrity of the Cisco IOS XR Software host system.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_ios_xr_software | — | — |
| cisco | ios_xr | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for unexpected inbound TCP connections to port 6379 on Cisco IOS XR devices running the health check RPM, which may indicate exploitation attempts against the exposed Redis instance inside the NOSi container. ↗
- →Detect unauthenticated Redis protocol traffic (e.g., RESP protocol commands) arriving on TCP/6379 from external/untrusted sources targeting Cisco IOS XR devices. ↗
- →Check whether the health check RPM is active on IOS XR devices; if so, verify TCP port 6379 is not externally reachable as a triage step. ↗
- ·The Redis instance runs inside a sandboxed NOSi container; remote code execution on the IOS XR host system is not possible via this vulnerability, limiting blast radius to the container scope. ↗
- ·The vulnerable port is only exposed when the health check RPM is activated; devices without the health check RPM active are not affected. ↗
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
vulncheck6.5MEDIUM
cisa6.5MEDIUM
vendor_cisco6.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Cisco IOS XR Open Port Vulnerability
cisa·2022-05-23·CVSS 6.5
CVE-2022-20821 [MEDIUM] CWE-923 Cisco IOS XR Open Port Vulnerability
Vulnerability: Cisco IOS XR Open Port Vulnerability
Affected: Cisco IOS XR
Cisco IOS XR software health check opens TCP port 6379 by default on activation. An attacker can connect to the Redis instance on the open port and allow access to the Redis instance that is running within the NOSi container.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2022-20821
Remediation Due Date: 2022-06-13
Cisco
Cisco IOS XR Software Health Check Open Port Vulnerability
vendor_cisco·2022-05-20·CVSS 6.5
CVE-2022-20821 [MEDIUM] CWE-200 Cisco IOS XR Software Health Check Open Port Vulnerability
Cisco IOS XR Software Health Check Open Port Vulnerability
A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container.
This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database. Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrit
Cisco
Cisco IOS XR Software Health Check Open Port Vulnerability
vendor_cisco·CVSS 3.1
CVE-2022-20821 Cisco IOS XR Software Health Check Open Port Vulnerability
CVE-2022-20821: Cisco IOS XR Software Health Check Open Port Vulnerability
A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database. Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abus
GHSA
GHSA-6whc-cmc9-99q6: A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is
ghsa_unreviewed·2022-05-27
CVE-2022-20821 [MEDIUM] CWE-200 GHSA-6whc-cmc9-99q6: A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is
A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database. Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrity of the Cisco IOS XR Software host system.
VulnCheck
Cisco IOS XR Open Port Vulnerability
vulncheck·2022·CVSS 6.5
CVE-2022-20821 [MEDIUM] CWE-923 Cisco IOS XR Open Port Vulnerability
Cisco IOS XR Open Port Vulnerability
Cisco IOS XR software health check opens TCP port 6379 by default on activation. An attacker can connect to the Redis instance on the open port and allow access to the Redis instance that is running within the NOSi container.
Affected: Cisco IOS XR
Required Action: Apply updates per vendor instructions.
Exploitation References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-redis-ABJyE5xK; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.mandiant.com/resources/blog/zero-days-exploited-2022
Remediation Due: 2022-06-13
No detection rules found.
No public exploits indexed.
2022-05-26
Published
2022-05-23
Added to CISA KEV
Exploited in the wild