CVE-2016-6367: cisco adaptive security appliance software

csirt@kutim:~/threat-intel/cve/CVE-2016-6367

CVSS 7.8 · High KEV · sudah dieksploitasi EPSS 22,6%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada cisco adaptive security appliance software. Skor CVSS 3.1 7.8 (High) menurut NVD. Masuk katalog KEV CISA pada 24 Mei 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.

Rincian

Terbit di NVD: 18 Agustus 2016
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
EPSS (30 hari): 22,6% peluang dieksploitasi; lebih tinggi dari 97,6% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability
Masuk KEV: 24 Mei 2022
Tenggat CISA: 14 Juni 2022 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply updates per vendor instructions.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
cisco	adaptive security appliance software	Versi 7.2.0 hingga sebelum 8.4\(3\)
cisco	adaptive security appliance software	Versi 8.5 hingga sebelum 9.0\(1\)

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://blogs.cisco.com/security/shadow-brokers exploit · press/media coverage · advisory vendor
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-cli advisory vendor
http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516 advisory vendor
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6367 pemerintah AS
http://www.securityfocus.com/bid/92520 broken link · advisory pihak ketiga · vdb entry
http://www.securitytracker.com/id/1036636 broken link · advisory pihak ketiga · vdb entry
https://www.exploit-db.com/exploits/40271/ advisory pihak ketiga · vdb entry
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40271.zip broken link · exploit

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.