cisco-sa-iosxr-redis-ABJyE5xK: Cisco IOS XR Software Health Check Open Port Vulnerability
First published: Fri May 20 2022(Updated: )
A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database. Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrity of the Cisco IOS XR Software host system. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-redis-ABJyE5xK
Credit: This vulnerability was found during the resolution a Cisco TAC support case
| Affected Software | Affected Version | How to fix |
|---|---|---|
| >=7.2 and earlier=7.3.15, 7.3.16, 7.3.1, and 7.3.2<=7.3.3<SMU ID: 8000-7.3.3.CSCwb82689 and 7.3.4 | SMU ID: 8000-7.3.3.CSCwb82689 and 7.3.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Cisco vulnerability?
The vulnerability ID for this Cisco vulnerability is cisco-sa-iosxr-redis-ABJyE5xK.
What is the title of this vulnerability?
The title of this vulnerability is Cisco IOS XR Software Health Check Open Port Vulnerability.
What is the severity of cisco-sa-iosxr-redis-ABJyE5xK?
The severity of cisco-sa-iosxr-redis-ABJyE5xK is medium with a severity value of 6.5.
Which software is affected by this vulnerability?
Cisco IOS XR Software versions 7.2 and earlier, 7.3.15, 7.3.16, 7.3.1, and 7.3.2 are affected by this vulnerability.
How can I fix cisco-sa-iosxr-redis-ABJyE5xK?
To fix cisco-sa-iosxr-redis-ABJyE5xK, apply the SMU ID: 8000-7.3.3.CSCwb82689 and 7.3.4 remedy for Cisco IOS XR Software.
- agent/type
- agent/first-publish-date
- collector/cisco-recent
- source/Cisco
- agent/severity
- agent/title
- agent/last-modified-date
- agent/weakness
- agent/description
- agent/author
- collector/cisco-advisory
- agent/software-canonical-lookup
- agent/references
- agent/remedy
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/cisco
- canonical/cisco ios xr
- version/cisco ios xr/7.2 and earlier
- version/cisco ios xr/7.3.15, 7.3.16, 7.3.1, and 7.3.2
- version/cisco ios xr/7.3.3