Cyber Resilience

CVE-2016-6366

HighCISA KEVActive ExploitationEUVD ExploitedPublic PoC

Published: 18 August 2016

Published
18 August 2016
Modified
22 April 2026
KEV Added
24 May 2022
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.9078 99.6th percentile
Risk Priority 92 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2016-6366 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Cisco Adaptive Security Appliance Software. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 0.4% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Deeper analysis

CVE-2016-6366 is a buffer overflow vulnerability, tracked as Bug ID CSCva92151 and also known as EXTRABACON, that affects Cisco Adaptive Security Appliance (ASA) Software through version 9.4.2.3. The flaw impacts multiple device families including ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM when processing crafted IPv4 SNMP packets. It is classified under CWE-120 with a CVSS 3.1 base score of 8.8.

Remote authenticated users can exploit the issue over the network by sending specially crafted IPv4 SNMP packets, enabling them to execute arbitrary code on the affected device with high impact to confidentiality, integrity, and availability.

Cisco published Security Advisory cisco-sa-20160817-asa-snmp along with related ERP and blog posts discussing the Shadow Brokers disclosure that referenced this vulnerability; the references point to official mitigation guidance and patch availability for supported releases. The flaw gained additional attention due to its association with the EXTRABACON tool in the Shadow Brokers leak of purported NSA exploits.

EU & UK References

Vulnerability details

Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices allows remote authenticated users to execute arbitrary code via…

more

crafted IPv4 SNMP packets, aka Bug ID CSCva92151 or EXTRABACON.

CWE(s)
CWE-120
KEV Date Added
24 May 2022

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

cisco
pix firewall software
all versions
cisco
adaptive security appliance software
7.2.1 — 9.0.4.40 · 9.1.1 — 9.1.7\(9\) · 9.2.0 — 9.2.4\(14\)
cisco
asa 1000v cloud firewall software
8.7.1, 8.7.1.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Input validation on SNMP packets directly blocks the crafted IPv4 packets that trigger the buffer overflow.

SI-16 Memory Protection good match
prevent

Memory protection mechanisms mitigate exploitation of the buffer overflow (CWE-120) to execute arbitrary code.

SI-2 Flaw Remediation good match
prevent

Timely application of Cisco patches for CSCva92151 eliminates the vulnerable SNMP processing code in ASA software.

References