Vulnerability

CVE-2022-20821

Medium· 6.5KEVCVSS6.5EPSS11%

.rules3/5

Cisco IOS XR Open Port Vulnerability

Cisco IOS XR software health check opens TCP port 6379 by default on activation. An attacker can connect to the Redis instance on the open port and allow access to the Redis instance that is running within the NOSi container.

Threat signal

77/100

High

Severity

medium

CVSS

6.5

EPSS

11%

Active

KEV

CISA KEV — actively exploited

1586d overdue

AffectedCisco — IOS XR

Added to KEV

2022-05-23

Federal patch due (BOD 22-01)

2022-06-13

Required action (CISA verbatim)

Apply updates per vendor instructions.

Vendor advisory + references

https://nvd.nist.gov/vuln/detail/CVE-2022-20821

CISA description: “Cisco IOS XR software health check opens TCP port 6379 by default on activation. An attacker can connect to the Redis instance on the open port and allow access to the Redis instance that is running within the NOSi container.”

CVSS

v3.1Open in FIRST calculator →

6.5/ 10MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack VectorNetworkExploitable remotely over the internet — no local access needed.
Attack ComplexityLowNo special conditions — exploit works reliably.
Privileges RequiredNoneUnauthenticated — no credentials needed.
User InteractionNoneFully automated — no victim action needed.
ScopeUnchangedImpact contained to the vulnerable component.
Confidentiality ImpactLowSome data disclosure; attacker doesn't fully control what.
Integrity ImpactLowSome data modification; attacker doesn't fully control extent.
Availability ImpactNoneNo availability impact.

EPSS

Exploit prediction · 30-day horizonFIRST.org →

11.5%

probability of exploitation in next 30 days

p96

higher than 96% of all CVEs

3-day trend↑ 0pp

Above the FIRST 'patch on a priority schedule' threshold.

Vendor VEX

No VEX statements published for CVE-2022-20821. Vendors publish VEX (Vulnerability Exploitability eXchange) to assert per-product whether a CVE is actually exploitable in their distribution.

SSVCAttend

Active exploitation with limited impact — coordinate patching

exploitation: active
automatable: no
impact: partial
mission: support

Lifecycle

2022-05-23Added to CISA KEVransomware: Unknown
2022-05-23Published
2022-05-23Last modified1 source
2022-06-13Federal patch due (BOD 22-01)