cisco adaptive-security-appliance-software CVE-2016-6367 is a vulnerability in Cisco Adaptive Security Appliance Software
Published on August 18, 2016

Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.

Vendor Advisory Vendor Advisory Vendor Advisory NVD

Known Exploited Vulnerability

This Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. A vulnerability in the command-line interface (CLI) parser of Cisco ASA software could allow an authenticated, local attacker to create a denial-of-service condition or potentially execute code.

The following remediation steps are recommended / required by June 14, 2022: Apply updates per vendor instructions.

Vulnerability Analysis

CVE-2016-6367 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 1.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.


Products Associated with CVE-2016-6367

You can be notified by stack.watch whenever vulnerabilities like CVE-2016-6367 are published in these products:

Cisco Adaptive Security Appliance Software
 

What versions of Adaptive Security Appliance Software are vulnerable to CVE-2016-6367?