CVE-2016-6367
published 2016-08-18CVE-2016-6367: Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid…
PriorityP182high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-06-14
Exploited in the wild
EPSS
22.58%
97.5th percentile
Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | adaptive_security_appliance | — | — |
| cisco | adaptive_security_appliance_software | >= 7.2.0 < 8.4\(3\) | 8.4\(3\) |
| cisco | adaptive_security_appliance_software | >= 8.5 < 9.0\(1\) | 9.0\(1\) |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit is triggered by invoking certain invalid CLI commands on affected Cisco ASA devices; monitor for anomalous or malformed CLI command sequences from authenticated local users. ↗
- →This vulnerability is publicly known as 'EPICBANANA' (also tracked as Bug ID CSCtu74257); threat intelligence and log searches should include this alias. ↗
- →Affects Cisco ASA Software versions before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices; flag any authentication events or privilege escalation on these platforms running vulnerable versions. ↗
- ·Exploitation requires an authenticated, local attacker; attack surface is limited to users with existing CLI access on the device. ↗
- ·There are no workarounds available; patching to ASA 8.4(1) or later is the only mitigation. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:L/AC:L/Au:S/C:C/I:C/A:C
vulncheck7.8HIGH
cisa7.8HIGH
vendor_cisco6.8MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability
cisa·2022-05-24·CVSS 7.8
CVE-2016-6367 [HIGH] CWE-77 Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability
Vulnerability: Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability
Affected: Cisco Adaptive Security Appliance (ASA)
A vulnerability in the command-line interface (CLI) parser of Cisco ASA software could allow an authenticated, local attacker to create a denial-of-service (DoS) condition or potentially execute code.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2016-6367
Remediation Due Date: 2022-06-14
Cisco
Cisco Adaptive Security Appliance CLI Remote Code Execution Vulnerability
vendor_cisco·2016-08-17·CVSS 6.8
CVE-2016-6367 [MEDIUM] CWE-119 Cisco Adaptive Security Appliance CLI Remote Code Execution Vulnerability
Cisco Adaptive Security Appliance CLI Remote Code Execution Vulnerability
A vulnerability in the command-line interface (CLI) parser of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, local attacker to create a denial of service (DoS) condition or potentially execute arbitrary code. An attacker could exploit this vulnerability by invoking certain invalid commands in an affected device.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-cli
Cisco
Cisco Adaptive Security Appliance CLI Remote Code Execution Vulnerability
vendor_cisco
CVE-2016-6367 Cisco Adaptive Security Appliance CLI Remote Code Execution Vulnerability
CVE-2016-6367: Cisco Adaptive Security Appliance CLI Remote Code Execution Vulnerability
A vulnerability in the command-line interface (CLI) parser of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, local attacker to create a denial of service (DoS) condition or potentially execute arbitrary code. An attacker could exploit this vulnerability by invoking certain invalid commands in an affected device. Cisco has released software updates that address this vulnerability. There are no
CWE: CWE-119, CWE-119
Bug IDs: CSCtu74257
GHSA
GHSA-cxx8-9qq9-rm4x: Cisco Adaptive Security Appliance (ASA) Software before 8
ghsa_unreviewed·2022-05-17
CVE-2016-6367 [HIGH] CWE-77 GHSA-cxx8-9qq9-rm4x: Cisco Adaptive Security Appliance (ASA) Software before 8
Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.
VulnCheck
Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability
vulncheck·2016·CVSS 7.8
CVE-2016-6367 [HIGH] CWE-77 Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability
Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability
A vulnerability in the command-line interface (CLI) parser of Cisco ASA software could allow an authenticated, local attacker to create a denial-of-service (DoS) condition or potentially execute code.
Affected: Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
Required Action: Apply updates per vendor instructions.
Exploitation References: https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit; https://www.cisa.gov/ncas/alerts/TA16-250A; https://cisa.gov/news-events/alerts/2015/08/01/recent-email-phishing-campaigns-mitigation-and-response; https://www.dropbox.com/s/buxkfotx1kei0ce/Whitepaper%20Shadow%20Broker%20-%20Equation%20Group%20Hack.pdf?dl=0;
No detection rules found.
No writeups or analysis indexed.
http://blogs.cisco.com/security/shadow-brokershttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-clihttp://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516http://www.securityfocus.com/bid/92520http://www.securitytracker.com/id/1036636https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40271.ziphttps://www.exploit-db.com/exploits/40271/http://blogs.cisco.com/security/shadow-brokershttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-clihttp://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516http://www.securityfocus.com/bid/92520http://www.securitytracker.com/id/1036636https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40271.ziphttps://www.exploit-db.com/exploits/40271/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6367
2016-08-18
Published
2022-05-24
Added to CISA KEV
Exploited in the wild