All the vulnerabilites related to cisco - ncs_5504
Vulnerability from fkie_nvd
Published
2023-09-13 17:15
Modified
2024-11-21 07:40
Severity ?
6.7 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
A vulnerability in the iPXE boot function of Cisco IOS XR software could allow an authenticated, local attacker to install an unverified software image on an affected device.
This vulnerability is due to insufficient image verification. An attacker could exploit this vulnerability by manipulating the boot parameters for image verification during the iPXE boot process on an affected device. A successful exploit could allow the attacker to boot an unverified software image on the affected device.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | ios_xr | * | |
| cisco | 8201 | - | |
| cisco | 8202 | - | |
| cisco | 8208 | - | |
| cisco | 8212 | - | |
| cisco | 8218 | - | |
| cisco | 8804 | - | |
| cisco | 8808 | - | |
| cisco | 8812 | - | |
| cisco | 8818 | - | |
| cisco | 8831 | - | |
| cisco | asr_9000 | - | |
| cisco | asr_9000v | - | |
| cisco | asr_9001 | - | |
| cisco | asr_9006 | - | |
| cisco | asr_9010 | - | |
| cisco | asr_9901 | - | |
| cisco | asr_9902 | - | |
| cisco | asr_9903 | - | |
| cisco | asr_9904 | - | |
| cisco | asr_9906 | - | |
| cisco | asr_9910 | - | |
| cisco | asr_9912 | - | |
| cisco | asr_9920 | - | |
| cisco | asr_9922 | - | |
| cisco | ncs_1001 | - | |
| cisco | ncs_1002 | - | |
| cisco | ncs_1004 | - | |
| cisco | ncs_4009 | - | |
| cisco | ncs_4016 | - | |
| cisco | ncs_4201 | - | |
| cisco | ncs_4202 | - | |
| cisco | ncs_4206 | - | |
| cisco | ncs_4216 | - | |
| cisco | ncs_5001 | - | |
| cisco | ncs_5002 | - | |
| cisco | ncs_5011 | - | |
| cisco | ncs_540 | - | |
| cisco | ncs_5500 | - | |
| cisco | ncs_5501 | - | |
| cisco | ncs_5501 | se | |
| cisco | ncs_5502 | - | |
| cisco | ncs_5502 | se | |
| cisco | ncs_5504 | - | |
| cisco | ncs_5508 | - | |
| cisco | ncs_5516 | - | |
| cisco | ncs_560 | - | |
| cisco | ncs_560-4 | - | |
| cisco | ncs_560-7 | - | |
| cisco | ncs_57b1-5dse-sys | - | |
| cisco | ncs_57b1-6d24-sys | - | |
| cisco | ncs_57c1-48q6-sys | - | |
| cisco | ncs_57c3-mod-sys | - | |
| cisco | ncs_57c3-mods-sys | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0F31C819-2725-4295-8FF3-BA00A7A6BE92",
"versionEndExcluding": "7.10.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:8201:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3D8E7FFF-82A8-4ECB-BA0C-CBF0C2FDA3A3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8202:-:*:*:*:*:*:*:*",
"matchCriteriaId": "87DC4C2F-01C5-4D89-8D79-E5D28EDAD0F2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8208:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A34DAD43-0C95-4830-8078-EFE3E6C0A930",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8212:-:*:*:*:*:*:*:*",
"matchCriteriaId": "46F5CBF0-7F55-44C0-B321-896BDBA22679",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8218:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D381E343-416F-42AF-A780-D330954F238F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8804:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6655851F-58D9-49D9-A56E-8440A7F7BB45",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8808:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F5E2AE67-DED3-4414-A194-386ADB2C8DC7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8812:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3920133A-684D-4A9F-B65A-FF4EAE5052E5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8818:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9ED06361-5A68-4656-AEA5-240C290594CD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8831:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BE2514A1-486C-40F7-8746-56E2B973CBE6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_9000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3FEF8271-315F-4756-931F-015F790BE693",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_9000v:-:*:*:*:*:*:*:*",
"matchCriteriaId": "71BD158E-71D8-4DCA-8C09-F8AB7EF0EBDD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_9001:-:*:*:*:*:*:*:*",
"matchCriteriaId": "324C97E6-1810-404F-9F45-6240F99FF039",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_9006:-:*:*:*:*:*:*:*",
"matchCriteriaId": "57EB55BB-41B7-40A1-B6F5-142FE8AB4C16",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_9010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "433F4A82-04A4-4EAA-8C19-F7581DCD8D29",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_9901:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2D5E60AB-94FF-448A-89D8-5D2197E21C74",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_9902:-:*:*:*:*:*:*:*",
"matchCriteriaId": "91474DBC-FB31-4DDF-96C5-311FA1D53A74",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_9903:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FA241214-2F05-4360-9B50-385355E29CF4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_9904:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A93212A4-50AB-42E7-89A4-5FBBAEA050C3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_9906:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EDA53A61-98B3-458C-8893-61CD7D6B1E48",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_9910:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F396564E-B477-4A27-A189-CEB737552E25",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_9912:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5445CC54-ACFB-4070-AF26-F91FEAA85181",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_9920:-:*:*:*:*:*:*:*",
"matchCriteriaId": "49E7ED87-8AC0-4107-A7A5-F334236E2906",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asr_9922:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D7AA58E5-D7E1-48CF-93FF-C60EB85B2BC7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_1001:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0F6E0FBE-70B7-413C-8943-39BEFE050298",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_1002:-:*:*:*:*:*:*:*",
"matchCriteriaId": "37AE5FB0-D9A6-4EBE-9F7F-243299AE918B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_1004:-:*:*:*:*:*:*:*",
"matchCriteriaId": "60C9AAF8-4C5B-4EF5-B575-8235F3C54BCC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_4009:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F40E779D-5865-4E4B-AE2D-CF1860BA19E2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_4016:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DC6A867F-E809-4CB5-82DB-2670CB0A6359",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_4201:-:*:*:*:*:*:*:*",
"matchCriteriaId": "41C5ECF8-EFFE-4C27-8DCB-2533BFD5200F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_4202:-:*:*:*:*:*:*:*",
"matchCriteriaId": "68C23248-3D61-4BAF-9602-BA31FB4374DD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_4206:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C36494B4-8E2D-4399-97B5-725792BD5C45",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_4216:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0819EF17-5102-45FF-96AD-85BE17FD6921",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5001:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E2A8C028-107B-4410-BCC6-5BCB8DB63603",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5002:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DA13FE67-F4AE-46DF-921B-3FB91BDF742B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5011:-:*:*:*:*:*:*:*",
"matchCriteriaId": "98622F14-CC47-45E0-85E4-A7243309487C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_540:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BC7AE6C1-B7C6-4056-9719-B5CFF71970AD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D686F339-9406-4ADF-B124-C815D43E4CAA",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5501:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0A972EFE-4F7E-4BFC-8631-66A2D16B74A3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5501:se:*:*:*:*:*:*:*",
"matchCriteriaId": "22FE69B4-DF27-46F1-8037-4B8D1F229C6B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5502:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7F72AEF0-EE70-40F8-B52B-1390820B87BB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5502:se:*:*:*:*:*:*:*",
"matchCriteriaId": "603980FE-9865-4A71-A37C-A90B7F3B72D6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5504:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6AC4E089-296D-4C19-BF21-DDF2501DD77C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5508:-:*:*:*:*:*:*:*",
"matchCriteriaId": "43D21B01-A754-474F-8E46-14D733AB307E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5516:-:*:*:*:*:*:*:*",
"matchCriteriaId": "17D6424C-972F-459C-B8F7-04FFD9F541BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_560:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D4CC8256-E4F8-4DCB-B69A-40A7C5AA41E8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_560-4:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BB01E968-E838-4D3C-B603-BF7E4E0F8A2C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_560-7:-:*:*:*:*:*:*:*",
"matchCriteriaId": "08864A59-0840-4407-8D30-9CE34BAF05E7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_57b1-5dse-sys:-:*:*:*:*:*:*:*",
"matchCriteriaId": "13EEDD1C-25BC-4AFA-AF60-66DE36927528",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_57b1-6d24-sys:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5CD3B06B-864E-4A35-B0C3-1654390022D2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_57c1-48q6-sys:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AD1B4F37-5AAA-4F40-8865-226289CB5CEB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_57c3-mod-sys:-:*:*:*:*:*:*:*",
"matchCriteriaId": "355F78C3-C07F-48C3-9B6E-55714EAA7331",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_57c3-mods-sys:-:*:*:*:*:*:*:*",
"matchCriteriaId": "98F06B5D-6CE8-42C3-8760-89B4EF1FFC21",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the iPXE boot function of Cisco IOS XR software could allow an authenticated, local attacker to install an unverified software image on an affected device.\r\n\r This vulnerability is due to insufficient image verification. An attacker could exploit this vulnerability by manipulating the boot parameters for image verification during the iPXE boot process on an affected device. A successful exploit could allow the attacker to boot an unverified software image on the affected device."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la funci\u00f3n de arranque iPXE del software Cisco IOS XR podr\u00eda permitir que un atacante local autenticado instale una imagen de software no verificada en un dispositivo afectado. Esta vulnerabilidad se debe a una verificaci\u00f3n de imagen insuficiente. Un atacante podr\u00eda aprovechar esta vulnerabilidad manipulando los par\u00e1metros de arranque para la verificaci\u00f3n de im\u00e1genes durante el proceso de arranque iPXE en un dispositivo afectado. Una explotaci\u00f3n exitosa podr\u00eda permitir al atacante iniciar una imagen de software no verificada en el dispositivo afectado."
}
],
"id": "CVE-2023-20236",
"lastModified": "2024-11-21T07:40:57.700",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 0.8,
"impactScore": 5.9,
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-09-13T17:15:09.607",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ipxe-sigbypass-pymfyqgB"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ipxe-sigbypass-pymfyqgB"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-347"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-345"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-05-26 14:15
Modified
2024-11-21 06:43
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Summary
A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database. Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrity of the Cisco IOS XR Software host system.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | ios_xr | - | |
| cisco | 8201 | - | |
| cisco | 8202 | - | |
| cisco | 8208 | - | |
| cisco | 8212 | - | |
| cisco | 8218 | - | |
| cisco | ncs-55a1-24h | - | |
| cisco | ncs-55a1-24q6h-s | - | |
| cisco | ncs-55a1-36h-s | - | |
| cisco | ncs-55a1-36h-se | - | |
| cisco | ncs-55a1-36h-se-s | - | |
| cisco | ncs-55a2-mod-hd-s | - | |
| cisco | ncs-55a2-mod-hx-s | - | |
| cisco | ncs-55a2-mod-s | - | |
| cisco | ncs-55a2-mod-se-h-s | - | |
| cisco | ncs-55a2-mod-se-s | - | |
| cisco | ncs_1001 | - | |
| cisco | ncs_1002 | - | |
| cisco | ncs_1004 | - | |
| cisco | ncs_5001 | - | |
| cisco | ncs_5002 | - | |
| cisco | ncs_5501-se | - | |
| cisco | ncs_5502-se | - | |
| cisco | ncs_5504 | - | |
| cisco | ncs_5508 | - | |
| cisco | ncs_5516 | - | |
| cisco | ncs_55a1 | - | |
| cisco | ncs_55a2 | - |
{
"cisaActionDue": "2022-06-13",
"cisaExploitAdd": "2022-05-23",
"cisaRequiredAction": "Apply updates per vendor instructions.",
"cisaVulnerabilityName": "Cisco IOS XR Open Port Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cisco:ios_xr:-:*:*:*:*:*:*:*",
"matchCriteriaId": "92587AA0-BDB6-4594-8F14-DC2A91FA4CD6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:8201:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3D8E7FFF-82A8-4ECB-BA0C-CBF0C2FDA3A3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8202:-:*:*:*:*:*:*:*",
"matchCriteriaId": "87DC4C2F-01C5-4D89-8D79-E5D28EDAD0F2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8208:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A34DAD43-0C95-4830-8078-EFE3E6C0A930",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8212:-:*:*:*:*:*:*:*",
"matchCriteriaId": "46F5CBF0-7F55-44C0-B321-896BDBA22679",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:8218:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D381E343-416F-42AF-A780-D330954F238F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs-55a1-24h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D8D61548-61B4-4B53-8574-9DB92B00A627",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs-55a1-24q6h-s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "74C8E3C6-282B-4394-A077-DF8694F7E55D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs-55a1-36h-s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4FF08FAF-67DD-4361-947A-40D5938DB8BA",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs-55a1-36h-se:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1CE2AD36-5D52-4489-AAC1-A7AC1B3D2581",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs-55a1-36h-se-s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "14E948CF-9891-4AC8-8734-9C121B611722",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs-55a2-mod-hd-s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A95FEA95-703B-44E0-A7CA-9E38B2EB1980",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs-55a2-mod-hx-s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2D37BF94-9D5F-4A88-8115-3A88FF144845",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs-55a2-mod-s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C33F0D81-1314-440B-9FC2-56D76CA4CD79",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs-55a2-mod-se-h-s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8E50806D-115D-4903-A5B2-62654FFDD9F5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs-55a2-mod-se-s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "15AE071E-0CEF-4305-A92D-9F4C324BD4ED",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_1001:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0F6E0FBE-70B7-413C-8943-39BEFE050298",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_1002:-:*:*:*:*:*:*:*",
"matchCriteriaId": "37AE5FB0-D9A6-4EBE-9F7F-243299AE918B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_1004:-:*:*:*:*:*:*:*",
"matchCriteriaId": "60C9AAF8-4C5B-4EF5-B575-8235F3C54BCC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5001:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E2A8C028-107B-4410-BCC6-5BCB8DB63603",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5002:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DA13FE67-F4AE-46DF-921B-3FB91BDF742B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5501-se:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1B254955-C485-45D7-A19B-E78CE1D997AD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5502-se:-:*:*:*:*:*:*:*",
"matchCriteriaId": "50C7B71A-2559-4E90-BAAA-C6FAAFE35FC3",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5504:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6AC4E089-296D-4C19-BF21-DDF2501DD77C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5508:-:*:*:*:*:*:*:*",
"matchCriteriaId": "43D21B01-A754-474F-8E46-14D733AB307E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_5516:-:*:*:*:*:*:*:*",
"matchCriteriaId": "17D6424C-972F-459C-B8F7-04FFD9F541BC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_55a1:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B51897CC-4FBF-4C99-BB69-2C528E392FE7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:ncs_55a2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "63ED034E-5A46-44A8-9101-8ACD6D334FF5",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database. Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrity of the Cisco IOS XR Software host system."
},
{
"lang": "es",
"value": "Una vulnerabilidad en el RPM de comprobaci\u00f3n de salud del software Cisco IOS XR podr\u00eda permitir a un atacante remoto no autenticado acceder a la instancia de Redis que es ejecutado dentro del contenedor NOSi. Esta vulnerabilidad se presenta porque el RPM de comprobaci\u00f3n de salud abre el puerto TCP 6379 por defecto al activarse. Un atacante podr\u00eda explotar esta vulnerabilidad al conectarse a la instancia de Redis en el puerto abierto. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante escribir en la base de datos en memoria de Redis, escribir archivos arbitrarios en el sistema de archivos del contenedor y recuperar informaci\u00f3n sobre la base de datos de Redis. Dada la configuraci\u00f3n del contenedor con sandbox en el que es ejecutada la instancia de Redis, un atacante remoto no podr\u00eda ejecutar c\u00f3digo remoto ni abusar de la integridad del sistema anfitri\u00f3n del software Cisco IOS XR"
}
],
"id": "CVE-2022-20821",
"lastModified": "2024-11-21T06:43:37.250",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 2.5,
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 2.5,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-05-26T14:15:08.123",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-redis-ABJyE5xK"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-redis-ABJyE5xK"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
cve-2023-20236
Vulnerability from cvelistv5
Published
2023-09-13 16:39
Modified
2024-10-23 19:10
Severity ?
EPSS score ?
Summary
A vulnerability in the iPXE boot function of Cisco IOS XR software could allow an authenticated, local attacker to install an unverified software image on an affected device.
This vulnerability is due to insufficient image verification. An attacker could exploit this vulnerability by manipulating the boot parameters for image verification during the iPXE boot process on an affected device. A successful exploit could allow the attacker to boot an unverified software image on the affected device.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco IOS XR Software |
Version: 5.2.0 Version: 5.2.1 Version: 5.2.2 Version: 5.2.4 Version: 5.2.3 Version: 5.2.5 Version: 5.2.47 Version: 5.3.0 Version: 5.3.1 Version: 5.3.2 Version: 5.3.3 Version: 5.3.4 Version: 6.0.0 Version: 6.0.1 Version: 6.0.2 Version: 6.1.1 Version: 6.1.2 Version: 6.1.3 Version: 6.1.4 Version: 6.1.12 Version: 6.1.22 Version: 6.1.32 Version: 6.1.36 Version: 6.1.42 Version: 6.2.1 Version: 6.2.2 Version: 6.2.3 Version: 6.2.25 Version: 6.2.11 Version: 6.3.2 Version: 6.3.3 Version: 6.3.15 Version: 6.4.1 Version: 6.4.2 Version: 6.4.3 Version: 6.5.1 Version: 6.5.2 Version: 6.5.3 Version: 6.5.25 Version: 6.5.26 Version: 6.5.28 Version: 6.5.29 Version: 6.5.32 Version: 6.5.33 Version: 6.6.2 Version: 6.6.3 Version: 6.6.25 Version: 6.6.4 Version: 7.0.1 Version: 7.0.2 Version: 7.0.12 Version: 7.0.14 Version: 7.1.1 Version: 7.1.15 Version: 7.1.2 Version: 7.1.3 Version: 6.7.1 Version: 6.7.2 Version: 6.7.3 Version: 6.7.4 Version: 7.2.0 Version: 7.2.1 Version: 7.2.2 Version: 7.3.1 Version: 7.3.15 Version: 7.3.2 Version: 7.3.3 Version: 7.3.5 Version: 7.4.1 Version: 7.4.2 Version: 6.8.1 Version: 6.8.2 Version: 7.5.1 Version: 7.5.3 Version: 7.5.2 Version: 7.5.4 Version: 7.6.1 Version: 7.6.2 Version: 7.7.1 Version: 7.7.2 Version: 7.7.21 Version: 6.9.1 Version: 6.9.2 Version: 7.8.1 Version: 7.8.2 Version: 7.9.1 Version: 7.9.2 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T09:05:35.905Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "cisco-sa-iosxr-ipxe-sigbypass-pymfyqgB",
"tags": [
"x_transferred"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ipxe-sigbypass-pymfyqgB"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:cisco:ios_xr_software:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ios_xr_software",
"vendor": "cisco",
"versions": [
{
"lessThanOrEqual": "7.9.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-20236",
"options": [
{
"Exploitation": "None"
},
{
"Automatable": "No"
},
{
"Technical Impact": "Total"
}
],
"role": "CISA Coordinator",
"timestamp": "2023-11-15T16:36:16.200980Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-23T19:10:48.388Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco IOS XR Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "5.2.0"
},
{
"status": "affected",
"version": "5.2.1"
},
{
"status": "affected",
"version": "5.2.2"
},
{
"status": "affected",
"version": "5.2.4"
},
{
"status": "affected",
"version": "5.2.3"
},
{
"status": "affected",
"version": "5.2.5"
},
{
"status": "affected",
"version": "5.2.47"
},
{
"status": "affected",
"version": "5.3.0"
},
{
"status": "affected",
"version": "5.3.1"
},
{
"status": "affected",
"version": "5.3.2"
},
{
"status": "affected",
"version": "5.3.3"
},
{
"status": "affected",
"version": "5.3.4"
},
{
"status": "affected",
"version": "6.0.0"
},
{
"status": "affected",
"version": "6.0.1"
},
{
"status": "affected",
"version": "6.0.2"
},
{
"status": "affected",
"version": "6.1.1"
},
{
"status": "affected",
"version": "6.1.2"
},
{
"status": "affected",
"version": "6.1.3"
},
{
"status": "affected",
"version": "6.1.4"
},
{
"status": "affected",
"version": "6.1.12"
},
{
"status": "affected",
"version": "6.1.22"
},
{
"status": "affected",
"version": "6.1.32"
},
{
"status": "affected",
"version": "6.1.36"
},
{
"status": "affected",
"version": "6.1.42"
},
{
"status": "affected",
"version": "6.2.1"
},
{
"status": "affected",
"version": "6.2.2"
},
{
"status": "affected",
"version": "6.2.3"
},
{
"status": "affected",
"version": "6.2.25"
},
{
"status": "affected",
"version": "6.2.11"
},
{
"status": "affected",
"version": "6.3.2"
},
{
"status": "affected",
"version": "6.3.3"
},
{
"status": "affected",
"version": "6.3.15"
},
{
"status": "affected",
"version": "6.4.1"
},
{
"status": "affected",
"version": "6.4.2"
},
{
"status": "affected",
"version": "6.4.3"
},
{
"status": "affected",
"version": "6.5.1"
},
{
"status": "affected",
"version": "6.5.2"
},
{
"status": "affected",
"version": "6.5.3"
},
{
"status": "affected",
"version": "6.5.25"
},
{
"status": "affected",
"version": "6.5.26"
},
{
"status": "affected",
"version": "6.5.28"
},
{
"status": "affected",
"version": "6.5.29"
},
{
"status": "affected",
"version": "6.5.32"
},
{
"status": "affected",
"version": "6.5.33"
},
{
"status": "affected",
"version": "6.6.2"
},
{
"status": "affected",
"version": "6.6.3"
},
{
"status": "affected",
"version": "6.6.25"
},
{
"status": "affected",
"version": "6.6.4"
},
{
"status": "affected",
"version": "7.0.1"
},
{
"status": "affected",
"version": "7.0.2"
},
{
"status": "affected",
"version": "7.0.12"
},
{
"status": "affected",
"version": "7.0.14"
},
{
"status": "affected",
"version": "7.1.1"
},
{
"status": "affected",
"version": "7.1.15"
},
{
"status": "affected",
"version": "7.1.2"
},
{
"status": "affected",
"version": "7.1.3"
},
{
"status": "affected",
"version": "6.7.1"
},
{
"status": "affected",
"version": "6.7.2"
},
{
"status": "affected",
"version": "6.7.3"
},
{
"status": "affected",
"version": "6.7.4"
},
{
"status": "affected",
"version": "7.2.0"
},
{
"status": "affected",
"version": "7.2.1"
},
{
"status": "affected",
"version": "7.2.2"
},
{
"status": "affected",
"version": "7.3.1"
},
{
"status": "affected",
"version": "7.3.15"
},
{
"status": "affected",
"version": "7.3.2"
},
{
"status": "affected",
"version": "7.3.3"
},
{
"status": "affected",
"version": "7.3.5"
},
{
"status": "affected",
"version": "7.4.1"
},
{
"status": "affected",
"version": "7.4.2"
},
{
"status": "affected",
"version": "6.8.1"
},
{
"status": "affected",
"version": "6.8.2"
},
{
"status": "affected",
"version": "7.5.1"
},
{
"status": "affected",
"version": "7.5.3"
},
{
"status": "affected",
"version": "7.5.2"
},
{
"status": "affected",
"version": "7.5.4"
},
{
"status": "affected",
"version": "7.6.1"
},
{
"status": "affected",
"version": "7.6.2"
},
{
"status": "affected",
"version": "7.7.1"
},
{
"status": "affected",
"version": "7.7.2"
},
{
"status": "affected",
"version": "7.7.21"
},
{
"status": "affected",
"version": "6.9.1"
},
{
"status": "affected",
"version": "6.9.2"
},
{
"status": "affected",
"version": "7.8.1"
},
{
"status": "affected",
"version": "7.8.2"
},
{
"status": "affected",
"version": "7.9.1"
},
{
"status": "affected",
"version": "7.9.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the iPXE boot function of Cisco IOS XR software could allow an authenticated, local attacker to install an unverified software image on an affected device.\r\n\r This vulnerability is due to insufficient image verification. An attacker could exploit this vulnerability by manipulating the boot parameters for image verification during the iPXE boot process on an affected device. A successful exploit could allow the attacker to boot an unverified software image on the affected device."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-07T19:50:10.951Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-iosxr-ipxe-sigbypass-pymfyqgB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ipxe-sigbypass-pymfyqgB"
}
],
"source": {
"advisory": "cisco-sa-iosxr-ipxe-sigbypass-pymfyqgB",
"defects": [
"CSCvz63925",
"CSCvz63918",
"CSCwe12502",
"CSCvz63929",
"CSCwi31568",
"CSCwh78724",
"CSCwi26526",
"CSCwh70601",
"CSCwh78727",
"CSCwj83430",
"CSCwj88475"
],
"discovery": "INTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2023-20236",
"datePublished": "2023-09-13T16:39:19.418Z",
"dateReserved": "2022-10-27T18:47:50.370Z",
"dateUpdated": "2024-10-23T19:10:48.388Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-20821
Vulnerability from cvelistv5
Published
2022-05-26 14:00
Modified
2024-10-29 16:11
Severity ?
EPSS score ?
Summary
A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database. Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrity of the Cisco IOS XR Software host system.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-redis-ABJyE5xK | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Cisco | Cisco IOS XR Software |
Version: n/a |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T02:24:49.991Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20220520 Cisco IOS XR Software Health Check Open Port Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-redis-ABJyE5xK"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-20821",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-29T16:11:07.480784Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2022-05-23",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-20821"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-29T16:11:35.841Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco IOS XR Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2022-05-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database. Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrity of the Cisco IOS XR Software host system."
}
],
"exploits": [
{
"lang": "en",
"value": "In May 2022, the Cisco PSIRT became aware of attempted exploitation of this vulnerability in the wild. Cisco strongly recommends that customers apply suitable workaround or upgrade to a fixed software release to remediate this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-26T14:00:31",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20220520 Cisco IOS XR Software Health Check Open Port Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-redis-ABJyE5xK"
}
],
"source": {
"advisory": "cisco-sa-iosxr-redis-ABJyE5xK",
"defect": [
[
"CSCwb82689"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco IOS XR Software Health Check Open Port Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2022-05-20T23:00:00",
"ID": "CVE-2022-20821",
"STATE": "PUBLIC",
"TITLE": "Cisco IOS XR Software Health Check Open Port Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco IOS XR Software",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database. Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrity of the Cisco IOS XR Software host system."
}
]
},
"exploit": [
{
"lang": "en",
"value": "In May 2022, the Cisco PSIRT became aware of attempted exploitation of this vulnerability in the wild. Cisco strongly recommends that customers apply suitable workaround or upgrade to a fixed software release to remediate this vulnerability."
}
],
"impact": {
"cvss": {
"baseScore": "6.5",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-200"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20220520 Cisco IOS XR Software Health Check Open Port Vulnerability",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-redis-ABJyE5xK"
}
]
},
"source": {
"advisory": "cisco-sa-iosxr-redis-ABJyE5xK",
"defect": [
[
"CSCwb82689"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2022-20821",
"datePublished": "2022-05-26T14:00:31.613559Z",
"dateReserved": "2021-11-02T00:00:00",
"dateUpdated": "2024-10-29T16:11:35.841Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}