CVE-2016-6367

Status: AnalyzedHigh (7.8)⚠ Active exploitation

Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base score: 7.8

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 23%
Percentile among all scored CVEs: 98
Score date: 10/3/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

CISA KEV — actively exploited

Added to catalog: 5/24/2022
Remediation due date: 6/14/2022
Known ransomware use: Unknown

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1068 Exploitation for Privilege Escalationprivilege escalation95 %
Primary impactT1059 Command and Scripting Interpreterexecution90 %

Vector AV:L con PR:L permite escalada local; CLI commands inválidos sugieren ejecución de comandos con privilegios elevados en dispositivo Cisco ASA.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Execution Prevention Threat Intelligence Program Restrict Web-Based Content Privileged Account Management Limit Software Installation Behavior Prevention on Endpoint

Affected technologies (1)

Cisco — Adaptive Security Appliance Software

CWEs

CWE-77
CWE-77

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2016-6367",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2016-6367",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-08T17:38:49.876850Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:S/C:C/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.1,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2016-08-18T18:59:01.463",
  "references": [
    {
      "url": "http://blogs.cisco.com/security/shadow-brokers",
      "tags": [
        "Exploit",
        "Press/Media Coverage",
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-cli",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/92520",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1036636",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40271.zip",
      "tags": [
        "Broken Link",
        "Exploit"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "https://www.exploit-db.com/exploits/40271/",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://blogs.cisco.com/security/shadow-brokers",
      "tags": [
        "Exploit",
        "Press/Media Coverage",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-cli",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/92520",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1036636",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40271.zip",
      "tags": [
        "Broken Link",
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/40271/",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6367",
      "tags": [
        "US Government Resource"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA."
    },
    {
      "lang": "es",
      "value": "Cisco Adaptive Security Applicance (ASA) Software en versiones anteriores a 8.4(1) en dispositivos ASA 5500, ASA 5500-X, PIX y FWSM permite a usuarios locales obtener privilegios a través de comandos CLI no válidos, también conocido como Bug ID CSCtu74257 o EPICBANANA."
    }
  ],
  "lastModified": "2026-06-17T00:50:54.407",
  "cisaActionDue": "2022-06-14",
  "cisaExploitAdd": "2022-05-24",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "647D339E-8D4B-44F6-AFF0-9525CAA61891",
              "versionEndExcluding": "8.4\\(3\\)",
              "versionStartIncluding": "7.2.0"
            },
            {
              "criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C605BF9-ADCB-4CBA-AC44-C896B3C610B3",
              "versionEndExcluding": "9.0\\(1\\)",
              "versionStartIncluding": "8.5"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:asa_5500:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "7018906A-ACDF-4D7B-B816-ED9C235BF04E"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5500-x:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "E10D97EB-51C4-4904-ABBA-5FCDC9B6D062"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5500_csc-ssm:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "DD44DFA7-9D3E-4158-9551-A698344F9022"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5505:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "8E6A8BB7-2000-4CA2-9DD7-89573CE4C73A"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5506-x:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "763B801D-CA1E-4C56-8B06-3373EA307C7E"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5506h-x:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "30AC6907-3091-409F-967D-64A82A0C5A8C"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5506w-x:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "D11AF728-8EB0-45EB-A7DD-F2D52B3BB7B8"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5508-x:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "92AE506A-E710-465B-B795-470FDE0E0ECA"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5510:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "B091B9BA-D4CA-435B-8D66-602B45F0E0BD"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5512-x:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "08F0F160-DAD2-48D4-B7B2-4818B2526F35"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5515-x:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "977D597B-F6DE-4438-AB02-06BE64D71EBE"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5516-x:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "1E07AF10-FFB2-4AC7-BBE7-199C3EFED81F"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5520:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "2B387F62-6341-434D-903F-9B72E7F84ECB"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5525-x:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "EB71EB29-0115-4307-A9F7-262394FD9FB0"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5540:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "17C5A524-E1D9-480F-B655-0680AA5BF720"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5545-x:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "57179F60-E330-4FF0-9664-B1E4637FF210"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5550:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "E6287D95-F564-44B7-A0F9-91396D7C2C4E"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5555-x:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "5535C936-391B-4619-AA03-B35265FC15D7"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5580:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "D1E828B8-5ECC-4A09-B2AD-DEDC558713DE"
            },
            {
              "criteria": "cpe:2.3:h:cisco:asa_5585-x:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "16AE20C2-C77E-4E04-BF13-A48696E52426"
            },
            {
              "criteria": "cpe:2.3:h:cisco:firewall_services_module:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "24AD881D-83B1-4A5D-ACDA-0CF5F8DC8EA9"
            },
            {
              "criteria": "cpe:2.3:h:cisco:pix_firewall_501:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "93103865-C140-4C93-9A7F-6EEF25958736"
            },
            {
              "criteria": "cpe:2.3:h:cisco:pix_firewall_506:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "32283245-33A1-41E2-B8CD-CFC2459F840B"
            },
            {
              "criteria": "cpe:2.3:h:cisco:pix_firewall_506e:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "107A6891-05FF-4812-B113-96247EDE136F"
            },
            {
              "criteria": "cpe:2.3:h:cisco:pix_firewall_515:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A35FF15C-5E02-4AD1-A4E6-E40E93A9F8F5"
            },
            {
              "criteria": "cpe:2.3:h:cisco:pix_firewall_515e:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "008185AD-BF4E-49ED-B3A8-FDA7F82D94E3"
            },
            {
              "criteria": "cpe:2.3:h:cisco:pix_firewall_520:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "D1D1DB6E-2C3C-4844-A76E-D679735BC150"
            },
            {
              "criteria": "cpe:2.3:h:cisco:pix_firewall_525:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "B7181264-0852-4637-A9C0-86CD3BB978AC"
            },
            {
              "criteria": "cpe:2.3:h:cisco:pix_firewall_535:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "488BE38C-6F9C-4652-92A5-F3626DBEE093"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/119.html\">CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer</a>",
  "sourceIdentifier": "psirt@cisco.com",
  "cisaRequiredAction": "Apply updates per vendor instructions.",
  "cisaVulnerabilityName": "Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability"
}