CVE-2022-20821
Cisco IOS XR Open Port Vulnerability
Description
CVE-2022-20821 is a vulnerability in Cisco IOS XR software where the health check feature opens TCP port 6379 by default upon activation, exposing a Redis instance to unauthenticated remote access. An attacker can connect to the open Redis port within the NOSi container and potentially read or modify data, write to the container file system, or access the Redis instance running within the container. This default-open port configuration creates an unintended network exposure on Cisco IOS XR routers. CISA has added CVE-2022-20821 to its KEV catalog, and the EPSS percentile of 95.3% indicates very high exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | ios xr | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
Weakness Type
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-200 describes situations where a product exposes sensitive information or resources to unauthorized actors. In CVE-2022-20821, the Cisco IOS XR health check feature inadvertently exposes a Redis database instance on TCP port 6379, allowing unauthenticated remote attackers to access the Redis data store within the NOSi container without any credentials.
Learn more: CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
Impact Analysis
CVE-2022-20821 exposes a Redis instance on Cisco IOS XR routers to unauthenticated remote access, which can impact both confidentiality and integrity. An attacker with network access to TCP port 6379 can read all data stored in the Redis instance, potentially including sensitive health check data and network configuration information. The attacker can also write arbitrary data to the Redis store and potentially use Redis commands to write files to the container file system, which could be leveraged for further exploitation. The vulnerability requires no authentication or user interaction and is exploitable over the network. The EPSS percentile of 95.3% reflects very high exploitation activity. CISA has confirmed active exploitation and added CVE-2022-20821 to the KEV catalog, highlighting the risk to critical network infrastructure.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-20821 and added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 13, 2022. The EPSS percentile of 95.3% indicates very high exploitation probability. The vulnerability is straightforward to exploit, requiring only a network connection to TCP port 6379 on an affected router, as the exposed Redis instance requires no authentication. Standard Redis command-line tools can be used to interact with the exposed instance, making the barrier to exploitation extremely low. The exposure of Redis instances on internet-facing network equipment makes this vulnerability a high-priority target for attackers seeking to compromise network infrastructure.
Remediation
- Apply Cisco security updates to upgrade IOS XR software to a version that addresses CVE-2022-20821, as required by CISA's KEV catalog.
- If the health check feature is not needed, disable it to prevent the Redis port from being opened.
- Implement access control lists (ACLs) on the Cisco IOS XR router to block external access to TCP port 6379, ensuring that only authorized management systems can reach management interfaces.
- Verify that management plane interfaces on IOS XR routers are not exposed to the internet and are accessible only through a dedicated management network.
- Monitor for unauthorized connections to TCP port 6379 on affected routers and review Redis logs for indicators of unauthorized access or data manipulation.
Technical Details
CVE-2022-20821 is caused by a default configuration issue in the Cisco IOS XR health check feature. When the health check is activated, it starts a Redis instance within the NOSi (Network OS Infrastructure) container that listens on TCP port 6379, which is the default Redis port. This Redis instance is bound to all network interfaces without authentication, meaning any host that can reach TCP port 6379 on the router can connect using standard Redis protocol commands. The vulnerability is classified under CWE-200 because the health check feature inadvertently exposes an internal data store to external, unauthorized access. Through the Redis interface, an attacker can execute commands to read stored data, set arbitrary key-value pairs, and potentially use Redis persistence mechanisms to write files to the container file system. The impact is constrained to the NOSi container rather than the full IOS XR operating system, but the container's position within the router architecture still provides access to sensitive operational data.
Frequently Asked Questions
Is CVE-2022-20821 being actively exploited?
Yes, CVE-2022-20821 has been actively exploited. CISA has confirmed active exploitation and added it to the KEV catalog with a remediation deadline of June 13, 2022. The EPSS percentile of 95.3% indicates very high exploitation probability, driven by the ease of exploitation through standard Redis tools.
What products are affected by CVE-2022-20821?
CVE-2022-20821 affects Cisco IOS XR software when the health check feature is activated. This includes Cisco routers running IOS XR with the health check functionality enabled, which opens TCP port 6379 and exposes a Redis instance.
How do I fix CVE-2022-20821?
Apply Cisco security updates for IOS XR. If the health check feature is not required, disable it. Additionally, implement ACLs to block external access to TCP port 6379 and ensure management interfaces are not internet-exposed. See the Remediation section for details.
How severe is CVE-2022-20821?
CVE-2022-20821 exposes an unauthenticated Redis instance on network routing equipment with an EPSS percentile of 95.3%. While the direct impact is constrained to the NOSi container, unauthorized access to a Redis instance on critical network infrastructure poses significant risks to data confidentiality and integrity, and could be used as a stepping stone for further attacks.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.