Cisco IOS XR Software Health Check Open Port Vulnerability
Only affects Cisco 8000 Series Routers running a vulnerable IOS XR release with the health check RPM installed and active. Fixed in 7.3.4.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 7.3.4
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Cisco IOS XR Software with the health check RPM activated is affected. A remote, unauthenticated attacker could reach the Redis database running in the NOSi container through an open network port and write to the database, write arbitrary files into the container's filesystem, and read information about the database, though the sandboxed container prevents remote code execution or compromise of the host system.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database. Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrity of the Cisco IOS XR Software host system.
Timeline
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CVE published
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Cisco Cisco IOS XR Software
Version range not reported
References 1
Questions about CVE-2022-20821
What does this mean?
The health check RPM opens TCP port 6379 by default when activated. A remote attacker without authentication can reach the Redis instance in the NOSi container, write to its in-memory database, write arbitrary files to the container filesystem, and retrieve Redis database information. The advisory states that remote code execution and host system integrity abuse are not possible because the container is sandboxed.Source: sec.cloudapps.cisco.com
Am I affected, and how do I check?
Cisco 8000 Series Routers running a vulnerable Cisco IOS XR Software release with the health check RPM installed and active. To check a router, compare its IOS XR release against the fixed releases and check whether the health check RPM is installed and active.Source: sec.cloudapps.cisco.com
What should I do about it?
Upgrade to IOS XR Software 7.3.4 or later. For 7.3.3, install SMU 8000-7.3.3.CSCwb82689. If you cannot upgrade, disable the health check and remove the xr-healthcheck package, or block TCP port 6379 with an infrastructure ACL.Source: sec.cloudapps.cisco.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-05-23, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data