13-year-old Critical Redis RCE Vulnerability Let Attackers Gain Full Access to Host System
A critical remote code execution (RCE) vulnerability identified in Redis, known as RediShell, allows unauthorized access to the host system. This flaw, tracked as CVE-2025-49844, was discovered by Wiz Research and holds a CVSS severity score of 10.0.
A critical remote code execution (RCE) vulnerability identified in Redis, known as RediShell, allows unauthorized access to the host system. This flaw, tracked as CVE-2025-49844, was discovered by Wiz Research and holds a CVSS severity score of 10.0.
The vulnerability is a Use-After-Free (UAF) memory corruption issue present in the Redis source code for approximately 13 years. Exploitation requires post-authentication access, using a specially crafted Lua script. Due to Lua scripting being a default feature, attackers can bypass the Lua sandbox, achieving arbitrary code execution on the host.
The vulnerability can lead to complete system control, enabling actions such as data theft, deletion, encryption, system resource hijacking for activities like crypto mining, and lateral network movements. Given Redis's widespread use—estimated at 75% of cloud environments—the potential impact is significant.
Redis Instances Exposed to the Internet
Wiz Research's analysis identified approximately 330,000 Redis instances exposed to the internet, with around 60,000 lacking authentication. The default configuration of the official Redis container image, which represents 57% of installations, does not require authentication. This vulnerability allows unauthenticated attackers to execute malicious Lua scripts.
A critical remote code execution (RCE) vulnerability identified in Redis, known as RediShell, allows unauthorized access to the host system.
Instances restricted to internal networks are also vulnerable, as attackers with initial access can exploit the flaw for lateral movement to sensitive systems.
The attack begins with a malicious Lua script sent to a vulnerable Redis instance. Exploiting the UAF bug allows the attacker to establish a reverse shell for persistent access, enabling further host compromise through credential theft, malware installation, and data exfiltration.
On Tue, Oct 3, 2025, Redis issued a security advisory addressing CVE-2025-49844. Users are strongly advised to upgrade Redis instances, prioritizing internet-exposed or unauthenticated ones. Additional security measures include:
Enabling strong authentication Disabling Lua scripting if unnecessary Running Redis with a non-root user account with minimal privileges Implementing network-level access controls such as firewalls and Virtual Private Clouds (VPCs) to restrict access
Based on reporting by Cyber Security News.