CVE-2016-6366

KEVCisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability

Description

A buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) code of Cisco ASA software could allow an attacker to cause a reload of the affected system or to remotely execute code.

Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices allows remote authenticated users to execute arbitrary code via crafted IPv4 SNMP packets, aka Bug ID CSCva92151 or EXTRABACON.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

PublishedAug 18, 2016

Last modifiedJun 17, 2026

Added to KEVMay 24, 2022

Remediation dueJun 14, 2022

References

blogs.cisco.com/security/shadow-brokersExploitPress/Media Coverage
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-snmpVendor Advisory
tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516Vendor Advisory
securityfocus.com/bid/92521Broken LinkNot Applicable
securitytracker.com/id/1036637Broken LinkThird Party Advisory
github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40258.zipBroken LinkExploit
exploit-db.com/exploits/40258/Third Party AdvisoryVDB Entry
zerosum0x0.blogspot.com/2016/09/reverse-engineering-cisco-asa-for.htmlExploitTechnical Description
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6366US Government Resource

0 recent articles mention this CVE

Risk assessment · Critical

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1595 days
CVSS: 8.8 HIGH
EPSS (30-day exploit probability): 87.6% · top 1% of all CVEs
Weakness: CWE-120
Attack vector: Network, remotely reachable

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.