Cisco · Adaptive Security Appliance (ASA)
CVE-2016-6367
Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability
공격에 악용됨
높음 7.8 공격 가능성: 23%
무엇인가
Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.
CISA: A vulnerability in the command-line interface (CLI) parser of Cisco ASA software could allow an authenticated, local attacker to create a denial-of-service (DoS) condition or potentially execute code.
할 일
Apply updates per vendor instructions.
미국 연방 기관 조치 기한: 2022년 6월 14일
- CISA 목록에 추가됨
- 2022년 5월 24일
- 게시됨
- 2016년 8월 18일
- 심각도
- 높음 7.8 CVSS 3.1
- 향후 30일 내 공격 가능성(EPSS)
- 23% 알려진 모든 취약점 중 상위 2.3%
- 약점 유형
- CWE-77
- 자세히
- NVD · CVE.org · CISA
모든 참고 자료(7)
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-cli
- https://www.exploit-db.com/exploits/40271/
- http://blogs.cisco.com/security/shadow-brokers
- http://www.securitytracker.com/id/1036636
- http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516
- http://www.securityfocus.com/bid/92520
- https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40271.zip
Cisco의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2024. 11. 12. | Cross-Site Scripting (XSS) | Adaptive Security Appliance (ASA) | 보통 5.4 | 23% |
| 2022. 5. 24. | SNMP Buffer Overflow | Adaptive Security Appliance (ASA) | 높음 8.8 | 88% |
| 2021. 11. 3. | Denial-of-Service | Adaptive Security Appliance (ASA) | 높음 7.5 | 99.9% |
| 2026. 10. 14. | Relative Path Traversal | Secure Email Gateway | 치명적 9.8 | 2.2% |
| 2026. 9. 30. | Hex Encoding | Catalyst SD-WAN Manager | 치명적 9.8 | 39% |
| 2026. 9. 16. | Incorrect Use of Privileged APIs | Identity Services Engine | 치명적 10.0 | 76% |
| 2026. 9. 14. | SQL Injection | Secure Email Gateway | 치명적 9.8 | 30% |
| 2026. 9. 9. | Firewall Management Center Authentication Bypass Using an Alternate Path or Channel | Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | 치명적 10.0 | 88% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.