# CVE-2016-6367

Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.

- Page: https://www.vulneraibility.com/cve/CVE-2016-6367
- CVSS: 7.8
- Known exploited: yes, in CISA KEV since 2022-05-24; CISA due date 2022-06-14
- EPSS: 22.58% (percentile 97.7)
- Public exploit code: 1 on Exploit-DB (first 2016-08-19)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2024-11-08)
- Weakness: CWE-77
- Published: 2016-08-18

## Affected

- cisco:adaptive_security_appliance_software

## References

- [advisory] http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-cli
- [exploit] https://www.exploit-db.com/exploits/40271/
- [other] http://blogs.cisco.com/security/shadow-brokers
- [other] http://www.securitytracker.com/id/1036636
- [other] http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516
- [other] http://www.securityfocus.com/bid/92520
- [other] https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40271.zip
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6367

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.