GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2016-6367

Vulnerability from fkie_nvd - Published: 2016-08-18 18:59 - Updated: 2026-06-17 00:50
Severity
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.
References
psirt@cisco.comhttp://blogs.cisco.com/security/shadow-brokersExploit, Press/Media Coverage, Vendor Advisory
psirt@cisco.comhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-cliVendor Advisory
psirt@cisco.comhttp://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516Vendor Advisory
psirt@cisco.comhttp://www.securityfocus.com/bid/92520Broken Link, Third Party Advisory, VDB Entry
psirt@cisco.comhttp://www.securitytracker.com/id/1036636Broken Link, Third Party Advisory, VDB Entry
psirt@cisco.comhttps://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40271.zipBroken Link, Exploit
psirt@cisco.comhttps://www.exploit-db.com/exploits/40271/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://blogs.cisco.com/security/shadow-brokersExploit, Press/Media Coverage, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-cliVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/92520Broken Link, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1036636Broken Link, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40271.zipBroken Link, Exploit
af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/40271/Third Party Advisory, VDB Entry
134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6367US Government Resource
Impacted products
Vendor Product Version
cisco adaptive_security_appliance_software *
cisco adaptive_security_appliance_software *
cisco asa_5500 -
cisco asa_5500-x -
cisco asa_5500_csc-ssm -
cisco asa_5505 -
cisco asa_5506-x -
cisco asa_5506h-x -
cisco asa_5506w-x -
cisco asa_5508-x -
cisco asa_5510 -
cisco asa_5512-x -
cisco asa_5515-x -
cisco asa_5516-x -
cisco asa_5520 -
cisco asa_5525-x -
cisco asa_5540 -
cisco asa_5545-x -
cisco asa_5550 -
cisco asa_5555-x -
cisco asa_5580 -
cisco asa_5585-x -
cisco firewall_services_module -
cisco pix_firewall_501 -
cisco pix_firewall_506 -
cisco pix_firewall_506e -
cisco pix_firewall_515 -
cisco pix_firewall_515e -
cisco pix_firewall_520 -
cisco pix_firewall_525 -
cisco pix_firewall_535 -
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "psirt@cisco.com"
    }
  ],
  "cisaActionDue": "2022-06-14",
  "cisaExploitAdd": "2022-05-24",
  "cisaRequiredAction": "Apply updates per vendor instructions.",
  "cisaVulnerabilityName": "Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "647D339E-8D4B-44F6-AFF0-9525CAA61891",
              "versionEndExcluding": "8.4\\(3\\)",
              "versionStartIncluding": "7.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0C605BF9-ADCB-4CBA-AC44-C896B3C610B3",
              "versionEndExcluding": "9.0\\(1\\)",
              "versionStartIncluding": "8.5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:asa_5500:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7018906A-ACDF-4D7B-B816-ED9C235BF04E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5500-x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E10D97EB-51C4-4904-ABBA-5FCDC9B6D062",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5500_csc-ssm:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD44DFA7-9D3E-4158-9551-A698344F9022",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5505:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E6A8BB7-2000-4CA2-9DD7-89573CE4C73A",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5506-x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "763B801D-CA1E-4C56-8B06-3373EA307C7E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5506h-x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "30AC6907-3091-409F-967D-64A82A0C5A8C",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5506w-x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D11AF728-8EB0-45EB-A7DD-F2D52B3BB7B8",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5508-x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "92AE506A-E710-465B-B795-470FDE0E0ECA",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5510:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B091B9BA-D4CA-435B-8D66-602B45F0E0BD",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5512-x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "08F0F160-DAD2-48D4-B7B2-4818B2526F35",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5515-x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "977D597B-F6DE-4438-AB02-06BE64D71EBE",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5516-x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "1E07AF10-FFB2-4AC7-BBE7-199C3EFED81F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5520:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2B387F62-6341-434D-903F-9B72E7F84ECB",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5525-x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB71EB29-0115-4307-A9F7-262394FD9FB0",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5540:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "17C5A524-E1D9-480F-B655-0680AA5BF720",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5545-x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "57179F60-E330-4FF0-9664-B1E4637FF210",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5550:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E6287D95-F564-44B7-A0F9-91396D7C2C4E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5555-x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5535C936-391B-4619-AA03-B35265FC15D7",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5580:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D1E828B8-5ECC-4A09-B2AD-DEDC558713DE",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5585-x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "16AE20C2-C77E-4E04-BF13-A48696E52426",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:firewall_services_module:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "24AD881D-83B1-4A5D-ACDA-0CF5F8DC8EA9",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:pix_firewall_501:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "93103865-C140-4C93-9A7F-6EEF25958736",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:pix_firewall_506:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "32283245-33A1-41E2-B8CD-CFC2459F840B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:pix_firewall_506e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "107A6891-05FF-4812-B113-96247EDE136F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:pix_firewall_515:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A35FF15C-5E02-4AD1-A4E6-E40E93A9F8F5",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:pix_firewall_515e:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "008185AD-BF4E-49ED-B3A8-FDA7F82D94E3",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:pix_firewall_520:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D1D1DB6E-2C3C-4844-A76E-D679735BC150",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:pix_firewall_525:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B7181264-0852-4637-A9C0-86CD3BB978AC",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:cisco:pix_firewall_535:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "488BE38C-6F9C-4652-92A5-F3626DBEE093",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA."
    },
    {
      "lang": "es",
      "value": "Cisco Adaptive Security Applicance (ASA) Software en versiones anteriores a 8.4(1) en dispositivos ASA 5500, ASA 5500-X, PIX y FWSM permite a usuarios locales obtener privilegios a trav\u00e9s de comandos CLI no v\u00e1lidos, tambi\u00e9n conocido como Bug ID CSCtu74257 o EPICBANANA."
    }
  ],
  "evaluatorComment": "\u003ca href=\"http://cwe.mitre.org/data/definitions/119.html\"\u003eCWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer\u003c/a\u003e",
  "id": "CVE-2016-6367",
  "lastModified": "2026-06-17T00:50:54.407",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "SINGLE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 6.8,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:L/AC:L/Au:S/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2016-6367",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-11-08T17:38:49.876850Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2016-08-18T18:59:01.463",
  "references": [
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Exploit",
        "Press/Media Coverage",
        "Vendor Advisory"
      ],
      "url": "http://blogs.cisco.com/security/shadow-brokers"
    },
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-cli"
    },
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516"
    },
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/92520"
    },
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id/1036636"
    },
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Broken Link",
        "Exploit"
      ],
      "url": "https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40271.zip"
    },
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://www.exploit-db.com/exploits/40271/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Press/Media Coverage",
        "Vendor Advisory"
      ],
      "url": "http://blogs.cisco.com/security/shadow-brokers"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-cli"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/92520"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id/1036636"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link",
        "Exploit"
      ],
      "url": "https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40271.zip"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://www.exploit-db.com/exploits/40271/"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6367"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.