CVE-2016-6367: Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2022-05-24
EPSS: 22.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2016-08-18 · updated 2026-06-17
Weakness: CWE-77

Description

Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.

Affected products

Cisco ASA Software: from 7.2.0 before 8.4\(3\); from 8.5 before 9.0\(1\) — fixed in 8.4\(3\), 9.0\(1\)

How to fix

Upgrade to a fixed version: Cisco ASA Software 8.4\(3\), 9.0\(1\). Check the vendor advisory for mitigations.

References

http://blogs.cisco.com/security/shadow-brokers
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-cli
http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516
http://www.securityfocus.com/bid/92520
http://www.securitytracker.com/id/1036636
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40271.zip
https://www.exploit-db.com/exploits/40271/
http://blogs.cisco.com/security/shadow-brokers
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-cli
http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516
http://www.securityfocus.com/bid/92520
http://www.securitytracker.com/id/1036636

Get alerted when CVE-2016-6367 or the next vulnerability affects your stack