← Back

CVE-2016-6367

nvd nist
Published: Aug 18, 2016Modified: Apr 22, 2026CISA KEV

JSON object

Loading...
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: NVD

Description

Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.

Affected (2)

Cisco
1 product
Adaptive Security Appliance Software
Configuration A
2 vulnerable · 29 platform
Vulnerable SoftwareAffected Versions
Cisco
Adaptive Security Appliance Software
From 7.2.0 to 8.4\(3\)
Adaptive Security Appliance Software
From 8.5 to 9.0\(1\)
Running on/withPlatform Versions
Cisco
Asa 5500
All versions
Cisco
Asa 5500 X
All versions
Cisco
Asa 5500 Csc Ssm
All versions
Cisco
Asa 5505
All versions
Cisco
Asa 5506 X
All versions
Cisco
Asa 5506h X
All versions
Cisco
Asa 5506w X
All versions
Cisco
Asa 5508 X
All versions
Cisco
Asa 5510
All versions
Cisco
Asa 5512 X
All versions
Cisco
Asa 5515 X
All versions
Cisco
Asa 5516 X
All versions
Cisco
Asa 5520
All versions
Cisco
Asa 5525 X
All versions
Cisco
Asa 5540
All versions
Cisco
Asa 5545 X
All versions
Cisco
Asa 5550
All versions
Cisco
Asa 5555 X
All versions
Cisco
Asa 5580
All versions
Cisco
Asa 5585 X
All versions
Cisco
Firewall Services Module
All versions
Cisco
Pix Firewall 501
All versions
Cisco
Pix Firewall 506
All versions
Cisco
Pix Firewall 506e
All versions
Cisco
Pix Firewall 515
All versions
Cisco
Pix Firewall 515e
All versions
Cisco
Pix Firewall 520
All versions
Cisco
Pix Firewall 525
All versions
Cisco
Pix Firewall 535
All versions

Related CWEs

CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (15)

Source: psirt@cisco.com
ExploitPress/Media CoverageVendor Advisory
Source: psirt@cisco.com
Vendor Advisory
Source: psirt@cisco.com
Vendor Advisory
Source: psirt@cisco.com
Broken LinkThird Party AdvisoryVDB Entry
Source: psirt@cisco.com
Broken LinkThird Party AdvisoryVDB Entry
Source: psirt@cisco.com
Broken LinkExploit
Source: psirt@cisco.com
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitPress/Media CoverageVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Broken LinkThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Broken LinkThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Broken LinkExploit
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

Timeline

No history available yet.