CVE-2022-20821: Cisco IOS XR Software Health Check Open Port Vulnerability

1. In CISA KEVCISA KEV catalogue23 May 2022
2. Exploited (reported): not seen
3. Scanning observed: not seen
4. Proof of concept public: not seen
5. Not established: not seen

DescriptionCVE.org

A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database. Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrity of the Cisco IOS XR Software host system.

• Cisco · Cisco IOS XR SoftwareVersions not stated

Exploitation

Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalogue.

CISA KEV

Listed since 23 May 2022 · catalogue entry

Public check

No public nuclei template

Weakness

Information Exposure · Information Disclosure

Vendor

Cisco

Published

May 2022

Band

Exploited in the wild, May 2022

1. 23 May 2022
   CISA added it to the KEV catalogue CISA

• NVD entrynvd.nist.gov
• CISA KEV cataloguecisa.gov
• CVE recordcve.org
• Weakness CWE-200cwe.mitre.org
• Vendor advisorytools.cisco.com