← CVE Radar
CVE-2016-6366Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability
Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices allows remote authenticated users to execute arbitrary code via crafted IPv4 SNMP packets, aka Bug ID CSCva92151 or EXTRABACON.
8.8 HIGHEPSS 87.56%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 8.8 | HIGH | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 8.5 | HIGH | 2.0NVD | AV:N/AC:M/Au:S/C:C/I:C/A:C |
CISA required action
⚡ Known exploited · remediation due Jun 14, 2022
Apply updates per vendor instructions.
Details
- CVE ID
- CVE-2016-6366
- Status
- Analyzed
- Assigner (CNA)
- cisco
- Published
- Aug 18, 2016
- Last modified
- 2026-06-17 00:50 UTC
Affected Products
From NVD CPE configurations.
ciscopix firewall software0 version ranges
No version detail published.
ciscoadaptive security appliance software7 version ranges
- 7.2.1 before 9.0.4.40
- 9.1.1 before 9.1.7(9)
- 9.2.0 before 9.2.4(14)
- 9.3.0 before 9.3.3(10)
- 9.4.0.115 before 9.4.3(8)
- 9.5.0 through 9.5(3)
- 9.6.0 before 9.6.1(11)
ciscoasa 1000v cloud firewall software2 version ranges
- 8.7.1
- 8.7.1.1
References
- blogs.cisco.com http://blogs.cisco.com/security/shadow-brokers
- tools.cisco.com http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-snmp
- tools.cisco.com http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516
- securityfocus.com http://www.securityfocus.com/bid/92521
- securitytracker.com http://www.securitytracker.com/id/1036637
- github.com https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40258.zip
- exploit-db.com https://www.exploit-db.com/exploits/40258/
- zerosum0x0.blogspot.com https://zerosum0x0.blogspot.com/2016/09/reverse-engineering-cisco-asa-for.html
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6366