CVE-2022-20821: Cisco IOS XR Information Disclosure Flaw

CVE-2022-20821 Overview

A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation, exposing the Redis database service to the network without authentication.

An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database. Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrity of the Cisco IOS XR Software host system.

Critical Impact

This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Unauthenticated attackers can access and manipulate the Redis database, write arbitrary files to the container, and exfiltrate sensitive information from network infrastructure devices.

Affected Products

• Cisco IOS XR Software
• Cisco 8000 Series Routers (8201, 8202, 8208, 8212, 8218)
• Cisco Network Convergence System (NCS) 1000 Series (1001, 1002, 1004)
• Cisco NCS 5000 Series (5001, 5002)
• Cisco NCS 5500 Series (5501-SE, 5502-SE, 5504, 5508, 5516)
• Cisco NCS 55A1 and 55A2 Series variants

Discovery Timeline

• May 26, 2022 - CVE-2022-20821 published to NVD
• October 28, 2025 - Last updated in NVD database

Technical Details for CVE-2022-20821

Vulnerability Analysis

This information exposure vulnerability stems from an insecure default configuration in the health check RPM component of Cisco IOS XR Software. When the health check RPM is activated, it automatically opens TCP port 6379—the default Redis port—without implementing proper authentication or access controls. This design flaw allows any network-accessible attacker to interact directly with the Redis instance running within the NOSi (Network Operating System Infrastructure) container.

The vulnerability is particularly concerning because Redis, when exposed without authentication, provides significant capabilities to attackers. They can enumerate database contents, write arbitrary data to the in-memory store, and potentially leverage Redis's file writing capabilities to place malicious files on the container's filesystem.

While the containerized environment provides some isolation that prevents direct host system compromise or remote code execution on the underlying IOS XR platform, the exposed Redis instance still poses meaningful risks. Attackers can gather reconnaissance information about the network infrastructure, potentially disrupt health monitoring functions, and use the compromised container as a foothold for further attacks.

Root Cause

The root cause of CVE-2022-20821 is an insecure default configuration in the health check RPM component. The software automatically binds the Redis service to all network interfaces on TCP port 6379 upon activation, without implementing authentication mechanisms or restricting access to localhost-only connections. This violates the principle of least privilege and secure-by-default design practices, as the Redis instance should not be network-accessible without explicit administrator configuration and proper authentication.

Attack Vector

The attack vector for this vulnerability is network-based and requires no authentication or user interaction. An attacker with network connectivity to an affected Cisco device can directly connect to TCP port 6379 and interact with the Redis instance. The exploitation process involves:

1. Scanning for exposed Redis instances on port 6379 across Cisco IOS XR devices
2. Connecting to the Redis service using standard Redis client tools
3. Executing Redis commands to read database contents, write arbitrary data, or create files within the container filesystem
4. Leveraging gathered information for further network reconnaissance or lateral movement

The attack complexity is low as no special conditions or preparation are required beyond network access to the target device.

Detection Methods for CVE-2022-20821

Indicators of Compromise

• Unexpected network connections to TCP port 6379 on Cisco IOS XR devices
• Redis command execution logs showing connections from unauthorized IP addresses
• Anomalous files appearing within the NOSi container filesystem
• Unusual Redis database modifications or entries not associated with legitimate health check operations
• Network traffic analysis revealing Redis protocol communications from external sources

Detection Strategies

• Deploy network intrusion detection systems (IDS) with signatures for unauthorized Redis protocol traffic to network infrastructure devices
• Implement NetFlow or sFlow analysis to identify connections to port 6379 on Cisco routers and switches
• Monitor device logs for health check RPM activation events and correlate with network connection data
• Use vulnerability scanners to identify exposed Redis instances across the network infrastructure

Monitoring Recommendations

• Establish baseline network traffic patterns for Cisco IOS XR devices and alert on deviations, particularly port 6379 activity
• Configure SIEM rules to detect and alert on any external connections to Redis ports on network infrastructure
• Implement continuous vulnerability assessment scanning for all Cisco network devices
• Monitor CISA KEV updates and threat intelligence feeds for exploitation activity related to this vulnerability

How to Mitigate CVE-2022-20821

Immediate Actions Required

• Disable the health check RPM if it is not required for operational purposes
• Implement infrastructure access control lists (iACLs) to restrict access to port 6379 to authorized management networks only
• Apply Cisco's recommended security patches and software updates immediately
• Audit all Cisco IOS XR devices to determine if the health check RPM is installed and active
• Review network firewall rules to ensure TCP port 6379 is blocked from untrusted networks

Patch Information

Cisco has released security updates to address this vulnerability. Administrators should consult the Cisco Security Advisory for specific patch versions and upgrade guidance for their deployed software versions. Given this vulnerability's inclusion in the CISA Known Exploited Vulnerabilities Catalog, federal agencies and organizations following CISA guidance should prioritize remediation.

Workarounds

• Implement infrastructure access control lists (iACLs) to block external access to TCP port 6379 on affected devices
• Disable the health check RPM using the command no hw-module subslot all reload if the feature is not operationally required
• Segment network infrastructure management interfaces from general user and untrusted networks
• Deploy network-based access controls at the perimeter to prevent external access to Redis ports on internal infrastructure

# Cisco IOS XR ACL Configuration Example
# Block external access to Redis port 6379
ipv4 access-list PROTECT-REDIS
 10 deny tcp any host <device-ip> eq 6379
 20 permit ipv4 any any
!
interface MgmtEth0/RP0/CPU0/0
 ipv4 access-group PROTECT-REDIS ingress