Cisco fixes an IOS XR flaw actively exploited in the wild
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-20821 | Unauthenticated Redis Access via Open TCP 6379 in Cisco IOS XR Health Check RPM A vulnerability in the health check RPM of Cisco IOS XR Software causes TCP port 6379 to be opened by default when the RPM is activated, exposing the Redis instance running inside the NOSi container to unauthenticated, remote access. An attacker who can reach the exposed port simply connects to the Redis service; no credentials, authentication, or user interaction are required. A successful exploit allows the attacker to write to the Redis in-memory database, write arbitrary files to the container's filesystem, and retrieve information about the Redis database; because the container is sandboxed, the flaw does not permit remote code execution or compromise of the host IOS XR system. Any organization running Cisco IOS XR with the health check RPM activated and TCP 6379 remotely reachable is affected, which in practice means service-provider and large-enterprise router deployments. The flaw was added to CISA's Known Exploited Vulnerabilities Catalog on 2022-05-23 and was reported as actively exploited in the wild, although no public proof-of-concept code is known. Do: Apply updated IOS XR releases per Cisco's security advisory, prioritizing internet-facing routers since the flaw is listed as actively exploited in CISA's KEV. Until patching, restrict or ACL access to TCP port 6379 on IOS XR devices (including via control-plane filtering) and check whether the health check RPM is activated on each device. Monitor for unexpected connections to port 6379 and review the Redis database and container filesystem for signs of unauthorized writes. | 6.5 | 12% | KEV |
| largeplausibly on the order of tens of thousands of IOS XR-based carrier routers, with the directly exposed subset (RPM active and TCP 6379 reachable) likely smaller |
Full article416 words · extracted from securityaffairs.com · click to collapse
Cisco addressed a medium-severity vulnerability affecting IOS XR Software, the company warns that the flaw is actively exploited in the wild.
Cisco released security updates to address a medium-severity vulnerability affecting IOS XR Software, tracked as CVE-2022-20821 (CVSS score: 6.5), that threat actors are actively exploiting in attacks in the wild.
The flaw resides in the health check RPM of Cisco IOS XR Software, an unauthenticated, remote attacker could trigger the issue to access the Redis instance that is running within the NOSi container.
“This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database.” reads the security advisory published by Cisco. “Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrity of the Cisco IOS XR Software host system.”
The vulnerability impacts Cisco 8000 Series routers with the health check RPM installed and active.
Users can determine if the device is vulnerable, users can issue the run docker ps CLI command. The device is vulnerable if the output returns a docker container with the name NOSi like the following example:
Below are the workarounds that address this vulnerability:
- Option 1: This is the preferred method. Disable health check and explicitly disable the use cases.
- Option 2: Use an Infrastructure Access Control List (iACLs) to block port 6379.
“In May 2022, the Cisco PSIRT became aware of attempted exploitation of this vulnerability in the wild. Cisco strongly recommends that customers apply suitable workaround or upgrade to a fixed software release to remediate this vulnerability.” concludes the advisory.
Security Affairs is one of the finalists for the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS. I ask you to vote for me again (even if you have already done it), because this vote is for the final.
Please vote for Security Affairs and Pierluigi Paganini in every category that includes them (e.g. sections “The Underdogs – Best Personal (non-commercial) Security Blog” and “The Tech Whizz – Best Technical Blog”)
To nominate, please visit:
https://docs.google.com/forms/d/e/1FAIpQLSdNDzjvToMSq36YkIHQWwhma90SR0E9rLndflZ3Cu_gVI2Axw/viewform
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Cisco IOS XR)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/131516/security/cisco-ios-xr-flaw.html