CVE-2022-20821

Cisco IOS XR Software Health Check Open Port Vulnerability

MEDIUM

6.5

CVSS Score

Published: May 26, 2022 at 02:00 PM UTC

Updated: June 17, 2026 at 04:25 AM UTC

28 products affected across 1 vendorIOS Xr82018202

Using Cisco IOS XR Software by Cisco?

Get instant alerts when new vulnerabilities affect Cisco IOS XR Software - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.5

Exploitation

CISA KEV

Exploit prediction

EPSS 11%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score11.5%

EPSS (Exploit Prediction Scoring System) estimates a 11.5% chance this CVE is exploited in the wild within the next 30 days — higher than 96% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

Cisco IOS XR software health check opens TCP port 6379 by default on activation. An attacker can connect to the Redis instance on the open port and allow access to the Redis instance that is running within the NOSi container.

Required Action

Apply updates per vendor instructions.

Ransomware Use

Unknown

Added to KEV

May 23, 2022

Remediation Due

Jun 13, 2022

1602 days overdue

Notes

https://nvd.nist.gov/vuln/detail/CVE-2022-20821

Description

A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database. Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrity of the Cisco IOS XR Software host system.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

IOS Xr · Cisco

95%

All versions

cisco-8201 (environment) · cisco-8202 (environment) · cisco-8208 (environment) · cisco-8212 (environment) · cisco-8218 (environment) · cisco-ncs-1001 (environment) · cisco-ncs-1002 (environment) · cisco-ncs-1004 (environment) · cisco-ncs-5001 (environment) · cisco-ncs-5002 (environment) · cisco-ncs-5501-se (environment) · cisco-ncs-5502-se (environment) · cisco-ncs-5504 (environment) · cisco-ncs-5508 (environment) · cisco-ncs-5516 (environment) · cisco-ncs-55a1 (environment) · cisco-ncs-55a1-24h (environment) · cisco-ncs-55a1-24q6h-s (environment) · cisco-ncs-55a1-36h-s (environment) · cisco-ncs-55a1-36h-se (environment) · cisco-ncs-55a1-36h-se-s (environment) · cisco-ncs-55a2 (environment) · cisco-ncs-55a2-mod-hd-s (environment) · cisco-ncs-55a2-mod-hx-s (environment) · cisco-ncs-55a2-mod-s (environment) · cisco-ncs-55a2-mod-se-h-s (environment) · cisco-ncs-55a2-mod-se-s (environment)

8201 · Ciscodevice

80%

All versions

8202 · Ciscodevice

80%

All versions

8208 · Ciscodevice

80%

All versions

8212 · Ciscodevice

80%

All versions