CVE-2016-6366

Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow

8.8 HIGHActively exploited (CISA KEV)Public exploitEPSS 87.6%

Published18 Aug 2016
Added to CISA KEV24 May 2022
Remediation due14 Jun 2022

Description

Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices allows remote authenticated users to execute arbitrary code via crafted IPv4 SNMP packets, aka Bug ID CSCva92151 or EXTRABACON.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Cisco Adaptive Security Appliance Software≥ 7.2.1 < 9.0.4.40 · ≥ 9.1.1 < 9.1.7\(9\) · ≥ 9.2.0 < 9.2.4\(14\) · ≥ 9.3.0 < 9.3.3\(10\)

Cisco ASA 1000v Cloud Firewall Software8.7.1 · 8.7.1.1

Cisco Pix Firewall Softwareall versions

Remediation

Fixed in

Cisco Adaptive Security Appliance Software≥ 9.0.4.40

Patch & vendor advisories

References

http://blogs.cisco.com/security/shadow-brokersExploitPress/Media CoverageVendor Advisory
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40258.zipBroken LinkExploit
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6366US Government Resource
https://www.exploit-db.com/exploits/40258/Third Party AdvisoryVDB Entry
https://zerosum0x0.blogspot.com/2016/09/reverse-engineering-cisco-asa-for.htmlExploitTechnical Description
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-snmpVendor Advisory
http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516Vendor Advisory
http://www.securityfocus.com/bid/92521Broken LinkNot ApplicableThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1036637Broken LinkThird Party AdvisoryVDB Entry

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2016-6366 being actively exploited?

Yes. CVE-2016-6366 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 24 May 2022.

How severe is CVE-2016-6366?

CVE-2016-6366 has a CVSS 3.1 base score of 8.8, rated high. EPSS estimates a 87.6% probability of exploitation.

Which products are affected by CVE-2016-6366?

Affected products include Cisco Adaptive Security Appliance Software, Cisco ASA 1000v Cloud Firewall Software, Cisco Pix Firewall Software.

How do I fix CVE-2016-6366?

Upgrade affected software to a fixed version, for example Cisco Adaptive Security Appliance Software 9.0.4.40 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2016-6366 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.