{"schemaVersion":3,"id":"CVE-2016-6366","aliases":[],"status":"published","duplicateOf":null,"title":"Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability","description":"Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices allows remote authenticated users to execute arbitrary code via crafted IPv4 SNMP packets, aka Bug ID CSCva92151 or EXTRABACON.","dates":{"published":"2016-08-18T18:00:00.000Z","modified":"2026-01-12T20:50:50.619Z","reserved":null,"kevAdded":["2022-05-24T00:00:00.000Z"],"kevDue":["2022-06-14T00:00:00.000Z"]},"cvss":{"headline":{"score":8.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":8.5,"severity":"high","vector":"AV:N/AC:M/Au:S/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.87565,"percentile":0.99759,"severity":"critical","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.87565},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.87565,"percentile":0.99759}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.87565,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.87565,"percentile":0.99759}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-05-24T00:00:00.000Z","dueDate":"2022-06-14T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability","description":"A buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) code of Cisco ASA software could allow an attacker to cause a reload of the affected system or to remotely execute code.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2016-6366","label":"nvd.nist.gov/vuln/detail/CVE-2016-6366"}],"vendor":"Cisco","product":"Adaptive Security Appliance (ASA)","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-05-24T00:00:00.000Z","dueDate":"2022-06-14T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability","description":"A buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) code of Cisco ASA software could allow an attacker to cause a reload of the affected system or to remotely execute code.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2016-6366","label":"nvd.nist.gov/vuln/detail/CVE-2016-6366"}],"vendor":"Cisco","product":"Adaptive Security Appliance (ASA)","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_OFFENSIVE-SECURITY_EXPLOIT-DATABASE-BIN-SPLOITS","name":"Exploit Database Bin Sploits","source":"github","url":"https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40258.zip","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_D1A2278EB81D1707","name":"Exploit Reference (blogs.cisco.com)","source":"reference","url":"http://blogs.cisco.com/security/shadow-brokers","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_E1395AB910745CB2","name":"Exploit Reference (zerosum0x0.blogspot.com)","source":"reference","url":"https://zerosum0x0.blogspot.com/2016/09/reverse-engineering-cisco-asa-for.html","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"40258","name":"Cisco ASA 8.x - 'EXTRABACON' Authentication Bypass","source":"exploit-database","url":"https://www.exploit-db.com/exploits/40258","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":"remote","platforms":["hardware"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"remote","platform":"hardware","file":"exploits/hardware/remote/40258.txt","codes":["CVE-2016-6366"]},"metasploit":null},{"id":"MSF_AUXILIARY_ADMIN_NETWORKING_CISCO_ASA_EXTRABACON","name":"Cisco ASA Authentication Bypass (EXTRABACON)","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/networking/cisco_asa_extrabacon.rb","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"auxiliary/admin/networking/cisco_asa_extrabacon","rank":"300","rankName":"normal","postAuth":false,"check":true,"stability":[],"sideEffects":["ioc-in-logs","config-changes"],"reliability":[]}}],"exploitCount":5,"weaknesses":[{"id":"CWE-120","name":"Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')","description":"The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/120.html"}],"affected":[{"vendor":"cisco","product":"adaptive_security_appliance_software","name":"adaptive security appliance software","label":"adaptive_security_appliance_software","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 7.2.1, < 9.0.4.40","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.1.1, < 9.1.7\\(9\\)","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.2.0, < 9.2.4\\(14\\)","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.3.0, < 9.3.3\\(10\\)","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.4.0.115, < 9.4.3\\(8\\)","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.5.0, ≤ 9.5\\(3\\)","noFixRecorded":false,"fixedIn":null},{"text":"≥ 9.6.0, < 9.6.1\\(11\\)","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 7.2.1, < 9.0.4.40 | ≥ 9.1.1, < 9.1.7\\(9\\) | ≥ 9.2.0, < 9.2.4\\(14\\) | ≥ 9.3.0, < 9.3.3\\(10\\) | ≥ 9.4.0.115, < 9.4.3\\(8\\) | ≥ 9.5.0, ≤ 9.5\\(3\\) | ≥ 9.6.0, < 9.6.1\\(11\\)","eol":null,"hubHref":"/vendor/cisco/adaptive_security_appliance_software"},{"vendor":"cisco","product":"asa_1000v_cloud_firewall_software","name":"asa 1000v cloud firewall software","label":"asa_1000v_cloud_firewall_software","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"8.7.1","noFixRecorded":false,"fixedIn":null},{"text":"8.7.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"8.7.1 | 8.7.1.1","eol":null,"hubHref":"/vendor/cisco/asa_1000v_cloud_firewall_software"},{"vendor":"cisco","product":"pix_firewall_software","name":"pix firewall software","label":"pix_firewall_software","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/cisco/pix_firewall_software"}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.securityfocus.com/bid/92521","label":"www.securityfocus.com/bid/92521","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link","Not Applicable","Third Party Advisory"]},{"url":"https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40258.zip","label":"github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40258.zip","hostname":"github.com","tags":["X Refsource MISC","Broken Link","Exploit"]},{"url":"http://blogs.cisco.com/security/shadow-brokers","label":"blogs.cisco.com/security/shadow-brokers","hostname":"blogs.cisco.com","tags":["X Refsource CONFIRM","Exploit","Press/Media Coverage","Vendor Advisory"]},{"url":"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-snmp","label":"tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-snmp","hostname":"tools.cisco.com","tags":["Vendor Advisory","X Refsource CISCO"]},{"url":"http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516","label":"tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516","hostname":"tools.cisco.com","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"https://zerosum0x0.blogspot.com/2016/09/reverse-engineering-cisco-asa-for.html","label":"zerosum0x0.blogspot.com/2016/09/reverse-engineering-cisco-asa-for.html","hostname":"zerosum0x0.blogspot.com","tags":["X Refsource MISC","Exploit","Technical Description"]},{"url":"https://www.exploit-db.com/exploits/40258/","label":"www.exploit-db.com/exploits/40258/","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1036637","label":"www.securitytracker.com/id/1036637","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Broken Link","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6366","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6366","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2016-08-18T18:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2022-05-24T00:00:00.000Z","label":"Added to CISA KEV","detail":"Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-06-14T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2026-01-12T20:50:50.619Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T07:07:06.357Z","stale":false,"partial":false}}