Actively exploited in the wild
Cisco IOS XR Open Port Vulnerability
Cisco - IOS XR · Listed in the CISA KEV since 2022-05-23. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-20821
MediumCVSS 6.5KEVSummary
A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database. Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrity of the Cisco IOS XR Software host system.
Risk Assessment
An unauthenticated remote attacker could access the Redis instance, modify data, write files to the container, and retrieve database information. This could lead to a breach of confidentiality and integrity of data within the container, although it does not allow code execution on the host.
Recommendation
Update Cisco IOS XR to a version containing the fix. If possible, disable or restrict access to TCP port 6379 and consider filtering network traffic to the NOSi container.
Other vulnerabilities in Cisco IOS XR
See all- CVE-2016-6428High
Cisco IOS XR version 6.1.1 allows local users to execute arbitrary OS commands as root by leveraging admin privileges.
- CVE-2016-1456High
The CLI in Cisco IOS XR versions 6.x through 6.0.1 allows local users to execute arbitrary OS commands in a privileged context by leveraging unspecified container access.
- CVE-2016-1407High
Cisco IOS XR versions up to 5.3.2 mishandle Local Packet Transport Services (LPTS) flow-based entries, allowing remote attackers to cause a denial of service (session drop) by making many connection attempts to open TCP ports.
- CVE-2015-6432High
Cisco IOS XR versions 4.2.0, 4.3.0, 5.0.0, 5.1.0, 5.2.0, 5.2.2, 5.2.4, 5.3.0, and 5.3.2 do not properly restrict the number of Path Computation Elements (PCEs) for OSPF LSA opaque area updates, allowing remote attackers to cause a denial of service (device reload) via a crafted update.
- CVE-2015-0618High
Cisco IOS XR versions 5.0.1 and 5.2.1 on Network Convergence System 6000 devices and 5.1.3 and 5.1.4 on Carrier Routing System X devices allow remote attackers to cause a denial of service (line-card reload) via malformed IPv6 packets with extension headers.
- CVE-2014-3353High
Cisco IOS XR 4.3(.2) and earlier, used in Cisco Carrier Routing System (CRS), allows remote attackers to cause a denial of service by sending a malformed IPv6 packet.
- CVE-2026-20279Critical
A vulnerability in Cisco IOS XR Software relates to improper access control issues (CWE-284). It was discovered during an internal security review and addressed in software hardening releases.
- CVE-2026-20274Critical
A vulnerability in Cisco IOS XR Software relates to improper resource control issues (CWE-664). It was discovered during an internal security review and addressed in software hardening releases.
- CVE-2020-3118HighActively exploited
A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. It is due to improper validation of string input from certain fields in Cisco Discovery Protocol messages. Sending a malicious CDP packet could cause a stack overflow, potentially allowing code execution with administrative privileges.
- CVE-2009-2055MediumActively exploited
Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an invalid attribute, as demonstrated in the wild on 17 August 2009.
Original NVD description (English source)
A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database. Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrity of the Cisco IOS XR Software host system.