CVE-2022-20821

A vulnerability in the health check RPM of Cisco IOS XR Software causes TCP port 6379 to be opened by default when the RPM is activated, exposing the Redis instance running inside the NOSi container to unauthenticated, remote access. An attacker who can reach the exposed port simply connects to the Redis service; no credentials, authentication, or user interaction are required. A successful exploit allows the attacker to write to the Redis in-memory database, write arbitrary files to the container's filesystem, and retrieve information about the Redis database; because the container is sandboxed, the flaw does not permit remote code execution or compromise of the host IOS XR system. Any organization running Cisco IOS XR with the health check RPM activated and TCP 6379 remotely reachable is affected, which in practice means service-provider and large-enterprise router deployments. The flaw was added to CISA's Known Exploited Vulnerabilities Catalog on 2022-05-23 and was reported as actively exploited in the wild, although no public proof-of-concept code is known.

What to do: Apply updated IOS XR releases per Cisco's security advisory, prioritizing internet-facing routers since the flaw is listed as actively exploited in CISA's KEV. Until patching, restrict or ACL access to TCP port 6379 on IOS XR devices (including via control-plane filtering) and check whether the health check RPM is activated on each device. Monitor for unexpected connections to port 6379 and review the Redis database and container filesystem for signs of unauthorized writes.