CVE-2022-20821mediumunder attackCWE-200

CVE-2022-20821: medium-severity vulnerability in Cisco IOS XR Software

Cisco IOS XR Software Health Check Open Port Vulnerability

Published · Updated

Follow this CVE+ Monitor Cisco IOS XR

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Attendcvss 6.5epss 11%
from disclosure to weapon
Published on NVDMay 26
CISA KEVMay 23
Action required by CISAfederal deadline: 2022-06-13

Apply updates per vendor instructions.

In short

Cisco IOS XR Software exposes a Redis database on port 6379 without authentication, allowing remote attackers to read and write data to the database and container filesystem. While contained within a sandbox, this creates a risk of data manipulation and unauthorized access.

Technical detail

The health check RPM in Cisco IOS XR Software opens TCP port 6379 by default, exposing an unauthenticated Redis instance within the NOSi container. An unauthenticated remote attacker can connect to this port and perform read/write operations on the in-memory database and container filesystem; however, the sandboxed environment prevents host system compromise or remote code execution.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database. Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrity of the Cisco IOS XR Software host system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
Cisco · Cisco IOS XR Software
Related CVEs — Cisco IOS XR Software

In the same product, most dangerous first.

CVE-2020-3118HIGHCisco IOS XR Software Cisco Discovery Protocol Format String VulnerabilityEPSS 11.7%KEVCVE-2020-3566HIGHCisco IOS XR Software DVMRP Memory Exhaustion VulnerabilityEPSS 3.7%KEVCVE-2020-3569HIGHCisco IOS XR Software DVMRP Memory Exhaustion VulnerabilitiesEPSS 3.3%KEVCVE-2025-20363CRITICALCVE-2025-20363EPSS 7.2%CVE-2020-3284HIGHCisco IOS XR Software Enhanced Preboot eXecution Environment Unsigned Code Execution VulnerabilityEPSS 2.9%CVE-2019-1710CRITICALCisco IOS XR 64-Bit Software for Cisco ASR 9000 Series Aggregation Services Routers Network Isolation VulnerabilityEPSS 2.8%