⚠ Actively exploited
Added to CISA KEV on 2022-05-24. Federal agencies required to patch by 2022-06-14. Required action: Apply updates per vendor instructions..

CVE-2016-6367 — Command Injection in Cisco Adaptive Security Appliance Software

CWE-77 — Command InjectionCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer7 documents7 sources
Severity
7.8HIGHNVD
EPSS
23.1%
top 4.07%
CISA KEV
KEV
Added 2022-05-24
Due 2022-06-14
Exploit
Exploited in wild
Active exploitation observed
Affected products
1
Cisco Adaptive Security Appliance Software
Timeline
PublishedAug 18
KEV addedMay 24
KEV dueJun 14
CISA Required Action: Apply updates per vendor instructions.

Description

Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages1 packages

🔴Vulnerability Details

3
GHSA
GHSA-cxx8-9qq9-rm4x: Cisco Adaptive Security Appliance (ASA) Software before 8↗2022-05-17
▶
CVEList
CVE-2016-6367: Cisco Adaptive Security Appliance (ASA) Software before 8↗2016-08-18
▶
VulnCheck
Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability↗2016
▶

💥Exploits & PoCs

1
Exploit-DB
Cisco ASA / PIX - 'EPICBANANA' Local Privilege Escalation↗2016-08-19
▶

📋Vendor Advisories

2
CISA
Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability↗2022-05-24
▶
Cisco
Cisco Adaptive Security Appliance CLI Remote Code Execution Vulnerability↗2016-08-17
▶
CVE-2016-6367 — Command Injection in Cisco | cvebase