Cisco IOS XR Software Health Check RPM Redis Unauthenticated Remote Data Manipulation and Information Disclosure (CVE-2022-20821)

1. Vulnerability Overview & Root Cause

This vulnerability arises from a default configuration flaw (CWE-200) within the Health Check RPM package of Cisco IOS XR Software. When the Health Check feature is activated, it spawns a Redis instance intended for internal container communication. However, the RPM opens TCP port 6379 by default on all active interfaces without enforcing authentication. This allows any network-adjacent or remote attacker with routing access to establish a direct connection to the database.

2. Exploitation Mechanics & Attack Scenario

An attacker scans the target Cisco IOS XR device for an open TCP port 6379. Upon discovering the open port, the attacker uses standard Redis client tools to connect without providing credentials. Once connected, the attacker can execute arbitrary Redis commands to read sensitive diagnostic data, modify in-memory keys, or leverage Redis database dump configurations (e.g., 'dbfilename' and 'dir') to write arbitrary files into the local NOSi container filesystem.

3. Infrastructure & Business Impact

Due to the sandboxed nature of the NOSi container where the Redis instance resides, a remote attacker cannot directly execute arbitrary code on the underlying Cisco IOS XR host system or compromise host integrity. However, unauthorized database access allows attackers to manipulate health metrics, potentially blinding network operations center (NOC) monitoring tools, or exfiltrating system state information. Because this vulnerability is listed in the CISA KEV catalog, it represents a high-priority threat actively targeted by malicious actors.