7.8Hoch KEV

CVE-2016-6367Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability

cisco adaptive security appliance software Veröffentlicht: 2016-08-18 21:00 (vor 10 Jahren)

Bekannt ausgenutzt — Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability

CISA hat am 24.05.2022 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 14.06.2022.

Erforderliche Maßnahme: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2016-6367

Beschreibung

Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.

Schwachstellentyp (CWE): CWE-77

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
cisco	adaptive security appliance software	7.2.0 – < 8.4\(3\)

Referenzen und Patches

20160817 Cisco Adaptive Security Appliance CLI Remote Code Execution Vulnerability vendor-advisoryVendor Advisory
40271 exploitThird Party AdvisoryVDB Entry
http://blogs.cisco.com/security/shadow-brokers ExploitPress/Media CoverageVendor Advisory
1036636 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516 Vendor Advisory
92520 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40271.zip Broken LinkExploit
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6367 US Government Resource

CPE-Treffer (NVD) (2)

cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* ≥ 7.2.0 < 8.4\(3\)
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* ≥ 8.5 < 9.0\(1\)

CVSS-Score

7.8Hoch

Quelle: CISA-ADP · CVSS 3.1

Angriffsvektor: Lokal
Komplexität: Niedrig
Rechte erforderlich: Niedrig
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Hoch
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Alle Scores (4)

CISA-ADP	CVSS 3.1	7.8Hoch
nvd	CVSS 3.1	7.8Hoch
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	7.8Hoch
nvd	CVSS 2.0	6.8Mittel

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

22.58%

höher als 98 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: active
Automatisierbar: no
Technische Auswirkung: total

Zeitverlauf

ID reserviert2016-07-26
Veröffentlicht2016-08-18 21:00
Bei IP-DB eingegangen2026-10-24 23:33
In KEV aufgenommen2022-05-24
Zuletzt aktualisiert2026-06-17 03:50

Vergeben von (CNA): cisco
NVD-Status: Analyzed

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — Cisco IOS / IOS XE / ASA

8.6Hoch

CVE-2026-76418 KEV vor 7 Tagen

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability

Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software; Cisco Cisco Secure Firewall Threat Defense (FTD) Software

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unex…

7.5Hoch

CVE-2026-76505 vor 14 Tagen

Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerability

Cisco Cisco IOS XR Software

A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series Aggregation Services Routers as well as Cisco ASR 9902 and 9903 Compact High-Performance Routers could allow an unauthenticated, r…

5.8Mittel

CVE-2026-76489 vor 14 Tagen

Multiple Cisco Products Snort 3 Generic File Processing Memory Exhaustion Denial of Service Vulnerability

Cisco Cisco Open Source Snort3; Cisco Cisco Secure Firewall Threat Defense (FTD) Software

Multiple Cisco products are affected by a vulnerability in the memory management implementation of Snort 3 that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection…

5.3Mittel

CVE-2026-76445 vor 14 Tagen

Multiple Cisco Products Snort 3 Denial of Service Vulnerability

Cisco Cisco Open Source Snort3; Cisco Cisco Secure Firewall Threat Defense (FTD) Software; Cisco Cisco UTD SNORT IPS Engine Software

Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a denial of service (DoS) condition. The vulner…

7.5Hoch

CVE-2026-20356 vor 14 Tagen

Multiple Cisco Products Snort 3 Software Hardening Release: October 2026

Cisco Cisco Cyber Vision; Cisco Cisco Open Source Snort3; Cisco Cisco Secure Firewall Threat Defense (FTD) Software; Cisco Cisco UTD SNORT IPS Engine Software

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that add…

7.5Hoch

CVE-2026-20236 vor 14 Tagen

Multiple Cisco Products Snort 3 Software Hardening Release: October 2026

Cisco Cisco Cyber Vision; Cisco Cisco Open Source Snort3; Cisco Cisco Secure Firewall Threat Defense (FTD) Software; Cisco Cisco UTD SNORT IPS Engine Software