High severity · published Aug 18, 2016
CVE-2016-6366
Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability
In wildKEV
8.8
CVSS
87.6%
EPSS
Yes
On KEV
Description
Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices allows remote authenticated users to execute arbitrary code via crafted IPv4 SNMP packets, aka Bug ID CSCva92151 or EXTRABACON.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)87.6% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed May 24, 2022
Federal remediation dueJun 14, 2022
Ransomware campaign useNot known
Affected products
Which versions
AS
Adaptive Security Appliance Software · Cisco
7.2.1 before 9.0.4.40; 9.1.1 before 9.1.7\(9\); 9.2.0 before 9.2.4\(14\); 9.3.0 before 9.3.3\(10\); 9.4.0.115 before 9.4.3\(8\); 9.5.0 through 9.5\(3\); +1 more · source: NVD
A1
Asa 1000v Cloud Firewall Software · Cisco
8.7.1; 8.7.1.1 · source: NVD
PF
Pix Firewall Software · Cisco
All versions, or not specified · source: NVD
AS
Adaptive Security Appliance (ASA) · Cisco
All versions, or not specified · source: KEV
Affected product
AS
Adaptive Security Appliance Software
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-6366
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-6366
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
vdb-entry
http://www.securityfocus.com/bid/92521
x_refsource_MISC
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40258.zip
x_refsource_CONFIRM
http://blogs.cisco.com/security/shadow-brokers
vendor-advisory
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-snmp
x_refsource_CONFIRM
http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516
x_refsource_MISC
https://zerosum0x0.blogspot.com/2016/09/reverse-engineering-cisco-asa-for.html
More from Adaptive Security Appliance Software
9.9
CVE-2025-20333
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability
9.1
CVE-2023-20269
Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability
8.6
CVE-2026-20349
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability
8.6
CVE-2025-20362
Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability
8.6
CVE-2024-20353
Cisco ASA and FTD Denial of Service Vulnerability