Actively exploited · Published Aug 18, 2016 · Assigned by cisco

CVE-2016-6367

High 7.8 Exploited

In plain English

A high-severity command injection in Adaptive Security Appliance (ASA) from Cisco. Attackers are actively exploiting it in the wild (listed by CISA on May 24, 2022). The chance it is exploited in the next 30 days is estimated at 22.6% (higher than 98% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)22.6%top 2.3% of all CVEs

Exploited in the wildYesCISA KEV since May 24, 2022

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jun 14, 2022.

Official description

Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-77 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

20160817 Cisco Adaptive Security Appliance CLI Remote Code Execution Vulnerability vendor-advisory, x_refsource_CISCO
40271 exploit, x_refsource_EXPLOIT-DB
http://blogs.cisco.com/security/shadow-brokers x_refsource_CONFIRM
1036636 vdb-entry, x_refsource_SECTRACK
http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516 x_refsource_CONFIRM
92520 vdb-entry, x_refsource_BID
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40271.zip x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6367 government-resource