CVE-2016-6367
HighActively exploited (CISA KEV)
Description
Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.
SeverityHigh
CVSS7.8
Exploit probability—
Product
Cisco Adaptive Security Appliance (ASA)
PublishedAug 18, 2016
First seenAug 18, 2016
Added to KEVMay 24, 2022
Weakness typeCWE-77Command injection
How to fix
CISA required action
Apply updates per vendor instructions.
CISA due date: Jun 14, 2022Update
- cisco adaptive_security_appliance_software8.4\(3\), 9.0\(1\) or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco adaptive_security_appliance_software | 7.2.0 ≤ v < 8.4\(3\), 8.5 ≤ v < 9.0\(1\) | 8.4\(3\), 9.0\(1\) |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.