CVE-2016-6366
Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability
Description
CVE-2016-6366 is a buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) code of Cisco Adaptive Security Appliance (ASA) software that could allow an authenticated remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability was disclosed as part of the Shadow Brokers leak of tools attributed to the Equation Group, where it was known as the EXTRABACON exploit. Successful exploitation could give an attacker complete control over a critical network security device. CISA has added CVE-2016-6366 to its KEV catalog, and the EPSS percentile of 99.7% indicates near-certain exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | pix firewall software | - |
| cisco | adaptive security appliance software | >= 7.2.1, < 9.0.4.40; >= 9.1.1, < 9.1.7\(9\); >= 9.2.0, < 9.2.4\(14\); >= 9.3.0, < 9.3.3\(10\); >= 9.4.0.115, < 9.4.3\(8\); >= 9.5.0, <= 9.5\(3\); >= 9.6.0, < 9.6.1\(11\) |
| cisco | asa 1000v cloud firewall software | 8.7.1; 8.7.1.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://blogs.cisco.com/security/shadow-brokers(Exploit, Press/Media Coverage, Vendor Advisory)
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-snmp(Vendor Advisory)
- http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516(Vendor Advisory)
- http://www.securityfocus.com/bid/92521(Broken Link, Not Applicable, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1036637(Broken Link, Third Party Advisory, VDB Entry)
- https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40258.zip(Broken Link, Exploit)
- https://www.exploit-db.com/exploits/40258/(Third Party Advisory, VDB Entry)
- https://zerosum0x0.blogspot.com/2016/09/reverse-engineering-cisco-asa-for.html(Exploit, Technical Description)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6366(US Government Resource)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-119 describes a weakness where a product performs operations on a memory buffer without properly restricting those operations to the intended boundaries. In CVE-2016-6366, the Cisco ASA SNMP implementation contains a buffer overflow that occurs when processing crafted SNMP packets, allowing an authenticated attacker to overwrite memory and execute arbitrary code or crash the appliance.
Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
Impact Analysis
CVE-2016-6366 has severe impact given that Cisco ASA appliances are typically deployed as perimeter firewalls and VPN concentrators in enterprise networks. Exploitation can lead to either a denial-of-service through device reload or complete code execution on the appliance. The vulnerability requires SNMP authentication (knowledge of the community string), but SNMP community strings are often weak or default values in many deployments. Successful exploitation compromises confidentiality, integrity, and availability of the firewall device itself, and by extension, the entire network segment it protects. An attacker with code execution on the ASA could modify firewall rules, intercept traffic, create backdoor access, or pivot into the internal network. The EPSS percentile of 99.7% reflects near-certain exploitation activity, and CISA has confirmed active exploitation in the KEV catalog.
Exploit Maturity
CVE-2016-6366 has been actively exploited in the wild since the Shadow Brokers leak in August 2016. CISA has confirmed active exploitation and added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 14, 2022. The EPSS percentile of 99.7% places it among the most exploited vulnerabilities ever cataloged. The exploit, known as EXTRABACON, was part of the Equation Group toolset and was publicly released by the Shadow Brokers group. Public exploit code is widely available and has been adapted for use against multiple Cisco ASA versions. The exploit targets the SNMP service and, when combined with knowledge of the SNMP community string, enables reliable remote code execution on affected devices.
Remediation
- Apply Cisco security updates to upgrade the ASA software to a version that addresses CVE-2016-6366, as required by CISA's KEV catalog.
- Change all SNMP community strings from default values to strong, complex strings, and restrict SNMP access to authorized management stations only through access control lists (ACLs).
- If SNMP is not required on the ASA, disable it entirely to eliminate the attack surface.
- Use SNMPv3 with authentication and encryption instead of SNMPv1/v2c, which transmit community strings in cleartext.
- Monitor ASA logs for unexpected device reloads, SNMP authentication failures, or unusual SNMP traffic patterns that could indicate exploitation attempts.
Technical Details
CVE-2016-6366 is a buffer overflow in the SNMP packet processing code of Cisco ASA software. When the ASA receives specially crafted SNMP packets, the SNMP handler fails to properly validate the length of certain fields, causing a buffer overflow condition classified under CWE-119. An attacker who knows the SNMP community string can send malicious SNMP requests that overflow a stack or heap buffer, potentially overwriting return addresses or function pointers to redirect execution to attacker-supplied shellcode. The exploit requires network access to the SNMP service (typically UDP port 161) and valid SNMP credentials (community string for v1/v2c, or authentication credentials for v3). The EXTRABACON exploit from the Equation Group toolset demonstrated reliable code execution on multiple ASA hardware models and software versions, making it a highly effective tool for compromising enterprise perimeter security devices.
Frequently Asked Questions
Is CVE-2016-6366 being actively exploited?
Yes, CVE-2016-6366 has been actively exploited since the Shadow Brokers leak in 2016. CISA has confirmed active exploitation and added it to the KEV catalog. The EPSS percentile of 99.7% reflects near-certain exploitation, driven by the EXTRABACON public exploit tool.
What products are affected by CVE-2016-6366?
CVE-2016-6366 affects Cisco Adaptive Security Appliance (ASA) software across multiple hardware platforms. This includes the ASA 5500 series, ASA 5500-X series, and other platforms running vulnerable ASA software versions with SNMP enabled.
How do I fix CVE-2016-6366?
Apply the Cisco security update for the affected ASA software version. Additionally, change SNMP community strings to strong values, restrict SNMP access via ACLs, and consider upgrading to SNMPv3 or disabling SNMP entirely if not needed. See the Remediation section for details.
How severe is CVE-2016-6366?
CVE-2016-6366 is a buffer overflow vulnerability with an EPSS percentile of 99.7%. It enables remote code execution on enterprise firewall devices, which are typically the first line of defense for network security. Compromise of an ASA device can lead to full network infiltration, making this one of the most impactful vulnerabilities for enterprise perimeter security.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.