After observing active attempts at exploitation In-the-Wild, Cisco has patched a critical zero-day vulnerability affecting the health check Route Processor Module (RPM) of their IOS XR Software for 8000 series routers. The flaw, tracked as CVE-2022-20821, is described as a privilege escalation vulnerability stemming from a default configuration in the health check RPM that automatically opens TCP port 6379. Port 6379 is the default port for the Redis database service, an open-source in-memory NoSQL key-value data structure used as a database, cache, or message broker. It is deployed both as an open source and an enterprise service, mainly used to scale and quickly handle sudden peaks in resource demands while providing low latency and high throughput when real-time response times are vital. The exploitation of this vulnerability could allow unauthenticated attackers to remotely access internet-facing Redis instances running in NOSi Docker containers, allowing them to “write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database.” Although this is a critical vulnerability, it is on the lower end of critical because the NOSi Docker containers are sandboxed; the vulnerable Redis instance is isolated from the host system, making it impossible for the attacker to execute code remotely. CTIX analysts recommend all Cisco customers and network administrators update to the latest stable version immediately. Applying this patch in enterprise instances may induce a substantial negative impact to business processes, and to mitigate as much loss as possible, Cisco has also published mitigation techniques, such as disabling health check RPM or manually blocking port 6379 via an Infrastructure Access Control List (iACLs). This is not an alternative to patching vulnerable systems, and administrators should implement mitigation techniques so that they can best plan for patching their infrastructure. It should be noted that Redis is designed to only be accessible by trusted clients inside of trusted environments, and as a rule of thumb, exposing the Redis instance directly to the internet is considered a bad practice.