Actively exploited · Published Aug 18, 2016 · Assigned by cisco
CVE-2016-6366
High 8.8 Exploited
In plain English
A high-severity buffer overflow in Adaptive Security Appliance (ASA) from Cisco. Attackers are actively exploiting it in the wild (listed by CISA on May 24, 2022). The chance it is exploited in the next 30 days is estimated at 87.6% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jun 14, 2022.
Official description
Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices allows remote authenticated users to execute arbitrary code via crafted IPv4 SNMP packets, aka Bug ID CSCva92151 or EXTRABACON.
Affected products (as reported)
Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- 92521 vdb-entry, x_refsource_BID
- https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40258.zip x_refsource_MISC
- http://blogs.cisco.com/security/shadow-brokers x_refsource_CONFIRM
- 20160817 Cisco Adaptive Security Appliance SNMP Remote Code Execution Vulnerability vendor-advisory, x_refsource_CISCO
- http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516 x_refsource_CONFIRM
- https://zerosum0x0.blogspot.com/2016/09/reverse-engineering-cisco-asa-for.html x_refsource_MISC
- 40258 exploit, x_refsource_EXPLOIT-DB
- 1036637 vdb-entry, x_refsource_SECTRACK
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6366 government-resource