Cisco · Adaptive Security Appliance (ASA)
CVE-2016-6366
Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability
What it is
Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices allows remote authenticated users to execute arbitrary code via crafted IPv4 SNMP packets, aka Bug ID CSCva92151 or EXTRABACON.
CISA: A buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) code of Cisco ASA software could allow an attacker to cause a reload of the affected system or to remotely execute code.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: June 14, 2022
- Added to the CISA list
- May 24, 2022
- Published
- August 18, 2016
- Severity
- High 8.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 88% in the top 0.2% of all known vulnerabilities
- Weakness
- CWE-119
- More details
- NVD · CVE.org · CISA
All references (8)
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-snmp
- http://www.securityfocus.com/bid/92521
- https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40258.zip
- http://blogs.cisco.com/security/shadow-brokers
- http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516
- https://zerosum0x0.blogspot.com/2016/09/reverse-engineering-cisco-asa-for.html
- https://www.exploit-db.com/exploits/40258/
- http://www.securitytracker.com/id/1036637
More exploited flaws from Cisco
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Nov 12, 2024 | Cross-Site Scripting (XSS) | Adaptive Security Appliance (ASA) | Medium 5.4 | 23% |
| May 24, 2022 | CLI Remote Code Execution | Adaptive Security Appliance (ASA) | High 7.8 | 23% |
| Nov 3, 2021 | Denial-of-Service | Adaptive Security Appliance (ASA) | High 7.5 | 99.9% |
| Oct 14, 2026 | Relative Path Traversal | Secure Email Gateway | Critical 9.8 | 2.2% |
| Sep 30, 2026 | Hex Encoding | Catalyst SD-WAN Manager | Critical 9.8 | 39% |
| Sep 16, 2026 | Incorrect Use of Privileged APIs | Identity Services Engine | Critical 10.0 | 76% |
| Sep 14, 2026 | SQL Injection | Secure Email Gateway | Critical 9.8 | 30% |
| Sep 9, 2026 | Firewall Management Center Authentication Bypass Using an Alternate Path or Channel | Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | Critical 10.0 | 88% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.