NetSight
IP …
high8.8Known exploitedPublic exploit code

CVE-2016-6366

Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-05-24. Federal due date: 2022-06-14.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices allows remote authenticated users to execute arbitrary code via crafted IPv4 SNMP packets, aka Bug ID CSCva92151 or EXTRABACON.

Affected products

VendorProductAffected versions
CiscoPix Firewall Software
All versions
CiscoAdaptive Security Appliance Software
from 7.2.1 before 9.0.4.40
from 9.1.1 before 9.1.7\(9\)
from 9.2.0 before 9.2.4\(14\)
from 9.3.0 before 9.3.3\(10\)
from 9.4.0.115 before 9.4.3\(8\)
from 9.5.0 through 9.5\(3\)
CiscoAsa 1000v Cloud Firewall Software
Versions 8.7.1, 8.7.1.1

Weakness classification

CWE-120

References