8.8Alta KEV

CVE-2016-6366Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability

cisco pix firewall software; cisco adaptive security appliance software; cisco asa 1000v cloud firewall software Publicada: 2016-08-18 21:00 (hace 10 años)

Explotación conocida — Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability

CISA confirmó el 24.05.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 14.06.2022.

Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2016-6366

Descripción

Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices allows remote authenticated users to execute arbitrary code via crafted IPv4 SNMP packets, aka Bug ID CSCva92151 or EXTRABACON.

Debilidad (CWE): CWE-120

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
cisco	adaptive security appliance software	7.2.1 – < 9.0.4.40
cisco	asa 1000v cloud firewall software	8.7.1
cisco	pix firewall software	—

Referencias y parches

92521 vdb-entryBroken LinkNot ApplicableThird Party Advisory
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40258.zip Broken LinkExploit
http://blogs.cisco.com/security/shadow-brokers ExploitPress/Media CoverageVendor Advisory
20160817 Cisco Adaptive Security Appliance SNMP Remote Code Execution Vulnerability vendor-advisoryVendor Advisory
http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516 Vendor Advisory
https://zerosum0x0.blogspot.com/2016/09/reverse-engineering-cisco-asa-for.html ExploitTechnical Description
40258 exploitThird Party AdvisoryVDB Entry
1036637 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6366 US Government Resource

Coincidencias CPE (NVD) (10)

cpe:2.3:o:cisco:pix_firewall_software:-:*:*:*:*:*:*:*
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* ≥ 7.2.1 < 9.0.4.40
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* ≥ 9.1.1 < 9.1.7\(9\)
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* ≥ 9.2.0 < 9.2.4\(14\)
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* ≥ 9.3.0 < 9.3.3\(10\)
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* ≥ 9.4.0.115 < 9.4.3\(8\)
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* ≥ 9.5.0 ≤ 9.5\(3\)
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* ≥ 9.6.0 < 9.6.1\(11\)
cpe:2.3:o:cisco:asa_1000v_cloud_firewall_software:8.7.1:*:*:*:*:*:*:*
cpe:2.3:o:cisco:asa_1000v_cloud_firewall_software:8.7.1.1:*:*:*:*:*:*:*

Puntuación CVSS

8.8Alta

Fuente: CISA-ADP · CVSS 3.1

Vector de ataque: Red
Complejidad: Baja
Privilegios: Bajos
Interacción del usuario: Ninguna
Alcance: Sin cambio
Confidencialidad: Alto
Integridad: Alto
Disponibilidad: Alto

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Todas las puntuaciones (4)

CISA-ADP	CVSS 3.1	8.8Alta
nvd	CVSS 3.1	8.8Alta
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	8.8Alta
nvd	CVSS 2.0	8.5Alta

EPSS (probabilidad de explotación en 30 días)

87.56%

superior al 100 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: active
Automatizable: no
Impacto técnico: total

Cronología

ID reservado2016-07-26
Publicada2016-08-18 21:00
Llegó a IP-DB2026-10-24 23:33
Añadida a KEV2022-05-24
Última actualización2026-06-17 03:50

Asignada por (CNA): cisco
Estado en NVD: Analyzed

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — Cisco IOS / IOS XE / ASA

8.6Alta

CVE-2026-76418 KEV hace 17 días

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability

Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software; Cisco Cisco Secure Firewall Threat Defense (FTD) Software

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unex…

7.5Alta

CVE-2026-76505 hace 24 días

Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerability

Cisco Cisco IOS XR Software

A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series Aggregation Services Routers as well as Cisco ASR 9902 and 9903 Compact High-Performance Routers could allow an unauthenticated, r…

5.8Media

CVE-2026-76489 hace 24 días

Multiple Cisco Products Snort 3 Generic File Processing Memory Exhaustion Denial of Service Vulnerability

Cisco Cisco Open Source Snort3; Cisco Cisco Secure Firewall Threat Defense (FTD) Software

Multiple Cisco products are affected by a vulnerability in the memory management implementation of Snort 3 that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection…

5.3Media

CVE-2026-76445 hace 24 días

Multiple Cisco Products Snort 3 Denial of Service Vulnerability

Cisco Cisco Open Source Snort3; Cisco Cisco Secure Firewall Threat Defense (FTD) Software; Cisco Cisco UTD SNORT IPS Engine Software

Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a denial of service (DoS) condition. The vulner…

7.5Alta

CVE-2026-20356 hace 24 días

Multiple Cisco Products Snort 3 Software Hardening Release: October 2026

Cisco Cisco Cyber Vision; Cisco Cisco Open Source Snort3; Cisco Cisco Secure Firewall Threat Defense (FTD) Software; Cisco Cisco UTD SNORT IPS Engine Software

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that add…

7.5Alta

CVE-2026-20236 hace 24 días

Multiple Cisco Products Snort 3 Software Hardening Release: October 2026

Cisco Cisco Cyber Vision; Cisco Cisco Open Source Snort3; Cisco Cisco Secure Firewall Threat Defense (FTD) Software; Cisco Cisco UTD SNORT IPS Engine Software