{"id":"CVE-2016-6366","published":"2016-08-18T18:59:00Z","modified":"2026-06-17T00:50:54Z","title":"Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability","vendor":"Cisco","product":"Adaptive Security Appliance (ASA)","tier":"core","eol":null,"description":{"text":"Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices allows remote authenticated users to execute arbitrary code via crafted IPv4 SNMP packets, aka Bug ID CSCva92151 or EXTRABACON.","provenance":"source","from":"NVD"},"summary":{"text":"A buffer overflow in Cisco's Adaptive Security Appliance (ASA) Software, affecting ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices, lies in the handling of IPv4 SNMP packets. An attacker who has network access to the device and valid authentication credentials can send crafted IPv4 SNMP packets to execute arbitrary code.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:54:10Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.87565,"percentile":0.99758,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-05-24","dueDate":"2022-06-14","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-6366","provenance":"source"},"vulncheckKev":{"dateAdded":"2016-08-15","exploitedFirstSeen":"2016-08-15","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2016-08-15"},{"url":"https://www.cisa.gov/ncas/alerts/TA16-250A","date":"2016-09-28"},{"url":"https://cisa.gov/news-events/alerts/2015/08/01/recent-email-phishing-campaigns-mitigation-and-response","date":"2016-09-29"},{"url":"https://www.dropbox.com/s/buxkfotx1kei0ce/Whitepaper%20Shadow%20Broker%20-%20Equation%20Group%20Hack.pdf?dl=0","date":"2016-10-05"},{"url":"https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=a9c54f79-d780-437b-a7f5-a74960e299d5&CommunityKey=8af7f28f-02f1-4107-8639-93a60b6546d4&tab=librarydocuments","date":"2017-06-20"},{"url":"https://www.virusbulletin.com/virusbulletin/2018/03/vb2017-paper-router-all-evil-more-just-default-passwords-and-silly-scripts/","date":"2018-03-01"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-05-24"}],"evidenceTotal":7,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-120","name":"Buffer Copy without Checking Size of Input"},{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"}],"references":[{"url":"http://blogs.cisco.com/security/shadow-brokers","tags":["Exploit","Press/Media Coverage","Vendor Advisory"]},{"url":"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-snmp","tags":["Vendor Advisory"]},{"url":"http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516","tags":["Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/92521","tags":["Broken Link","Not Applicable","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1036637","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40258.zip","tags":["Broken Link","Exploit"]},{"url":"https://www.exploit-db.com/exploits/40258/","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://zerosum0x0.blogspot.com/2016/09/reverse-engineering-cisco-asa-for.html","tags":["Exploit","Technical Description"]},{"url":"http://blogs.cisco.com/security/shadow-brokers","tags":["Exploit","Press/Media Coverage","Vendor Advisory"]},{"url":"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-snmp","tags":["Vendor Advisory"]},{"url":"http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516","tags":["Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/92521","tags":["Broken Link","Not Applicable","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1036637","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40258.zip","tags":["Broken Link","Exploit"]},{"url":"https://www.exploit-db.com/exploits/40258/","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://zerosum0x0.blogspot.com/2016/09/reverse-engineering-cisco-asa-for.html","tags":["Exploit","Technical Description"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6366","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1210","name":"Exploitation of Remote Services","tactics":["lateral-movement"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote exploitation via crafted network packets","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows remote authenticated users to execute arbitrary code via crafted IPv4 SNMP packets","start":205,"end":294}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Arbitrary code execution on the device","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows remote authenticated users to execute arbitrary code","start":205,"end":264}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2016-7289","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-7289","exploited":true,"exploitedSince":"2022-05-24","provenance":"source"},"exploits":[{"id":40258,"url":"https://www.exploit-db.com/exploits/40258","title":"Cisco ASA 8.x - 'EXTRABACON' Authentication Bypass","type":"remote","platform":"hardware","date":"2016-08-18","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2016-08-18"},"pocGithub":{"count":1,"skipped":0,"earliest":"2016-09-20","earliestUrl":"https://github.com/RiskSense-Ops/CVE-2016-6366","repos":[{"name":"RiskSense-Ops/CVE-2016-6366","url":"https://github.com/RiskSense-Ops/CVE-2016-6366","stars":163,"created":"2016-09-20"}]},"metasploit":[{"name":"Cisco ASA Authentication Bypass (EXTRABACON)","module":"auxiliary/admin/networking/cisco_asa_extrabacon","type":"auxiliary","disclosureDate":null,"url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/networking/cisco_asa_extrabacon.rb"}],"first":{"date":"2016-08-18","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/40258"},"provenance":"source"},"exploitRefs":["http://blogs.cisco.com/security/shadow-brokers","https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40258.zip","https://zerosum0x0.blogspot.com/2016/09/reverse-engineering-cisco-asa-for.html","https://www.exploit-db.com/exploits/40258/"],"flow":[{"stage":"exploitation","techniques":["T1210"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"},{"stage":"related","techniques":["T1190","T1203"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2016-08-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2016-08-18","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6366","provenance":"source"},{"date":"2016-08-18","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-40258); later: PoC-in-GitHub 2016-09-20","url":"https://www.exploit-db.com/exploits/40258","provenance":"source"},{"date":"2022-05-24","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-05-24","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-7289","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Exploit-DB","daysToKev":2105},"priority":{"score":69.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3729 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9976"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 1 Exploit-DB entry; 1 NVD exploit link; 1 PoC-in-GitHub repo; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-cisco-asa-cwe-120"}}