CVE-2022-20821VulnerabilityPublished 05/23/2022Updated 10/24/2026

CVE-2022-20821: Cisco IOS XR Open Port Vulnerability

Affects Cisco IOS XRSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 05/23/2022
KEV deadline: 06/13/2022
EPSS: 11.5% chance of exploitation in 30 days – higher than 96% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2022-20821 (opens in a new tab)

Description

Cisco IOS XR software activates a health check feature that opens TCP port 6379 by default. This port exposes a Redis instance running within the NOSi container, which an attacker can connect to and potentially access. The vulnerability is known as CVE-2022-20821 and has been exploited in the wild. No specific affected versions or patch information are provided.

Summary

CVE-2022-20821 describes a vulnerability in Cisco IOS XR where the software health check feature opens TCP port 6379 by default upon activation. This port exposes a Redis instance running inside the NOSi container, allowing an attacker to connect to and access the Redis instance. The vulnerability is tracked by CWE-923 and has been exploited in the wild, indicating active threat usage. No vendor advisory or patch information is provided in the input data.

Impact

An attacker can connect to the Redis instance exposed on TCP port 6379 and gain access to the Redis service running within the NOSi container on Cisco IOS XR devices. This unauthorized access could lead to potential compromise of the device or data handled by the Redis instance. The vulnerability has been exploited in the wild, confirming active risk.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to TCP port 6379 on affected Cisco IOS XR devices to prevent unauthorized connections to the Redis instance.

Weaknesses

CWE-923Unclassified weakness (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:42:04 UTC

Weaknesses

References

Related threats