CVE-2016-6367

Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.

CVSS v3.1 NVD

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

6.8 MEDIUMAV:L/AC:L/Au:S/C:C/I:C/A:C

EPSS

22.58% chance of exploitation in the next 30 days, 98th percentile

CISA KEV

added 2022-05-24

Published

2016-08-18

Updated

2026-01-12

Proof-of-concept exploits (1)

• offensive-security/exploit-database-bin-sploits/raw/master/sploits/40271.zip

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/40271

Security advisories

• http://blogs.cisco.com/security/shadow-brokers
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-as…
• http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516
• http://www.securityfocus.com/bid/92520
• http://www.securitytracker.com/id/1036636

References

• CVE Record
• NVD entry

Related

• CVE-2013-1594
• CVE-2013-1595
• CVE-2013-1596
• CVE-2013-1597
• CVE-2013-1598
• CVE-2016-6366