CVE-2016-6367
Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability
Description
CVE-2016-6367 is a vulnerability in the command-line interface (CLI) parser of Cisco ASA software that allows an authenticated local attacker to create a denial-of-service (DoS) condition or potentially execute arbitrary code. The vulnerability exists because the CLI parser does not properly validate input, allowing a local attacker with command-line access to exploit the flaw through crafted CLI commands. This vulnerability was also part of the Shadow Brokers leak and linked to the Equation Group's EPICBANANA exploit tool. CISA has added CVE-2016-6367 to its KEV catalog, and the EPSS percentile of 95.8% indicates very high exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | adaptive security appliance software | >= 7.2.0, < 8.4\(3\); >= 8.5, < 9.0\(1\) |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://blogs.cisco.com/security/shadow-brokers(Exploit, Press/Media Coverage, Vendor Advisory)
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-cli(Vendor Advisory)
- http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516(Vendor Advisory)
- http://www.securityfocus.com/bid/92520(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1036636(Broken Link, Third Party Advisory, VDB Entry)
- https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40271.zip(Broken Link, Exploit)
- https://www.exploit-db.com/exploits/40271/(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6367(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
CWE-20 describes a weakness where a product receives input but does not validate or incorrectly validates that the input has the properties required to process the data safely and correctly. In CVE-2016-6367, the Cisco ASA CLI parser fails to properly validate user-supplied input in certain commands, allowing an authenticated local attacker to craft CLI input that causes a denial-of-service or potentially achieves code execution.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2016-6367 requires authenticated local access to the Cisco ASA command-line interface, which limits the initial attack vector compared to network-exploitable vulnerabilities. However, the impact is significant because ASA devices are critical security infrastructure. An attacker with CLI access can crash the device (causing a network outage for all traffic flowing through the firewall) or potentially achieve code execution, which would allow modification of firewall rules, creation of backdoor access, and interception of network traffic. The EPSS percentile of 95.8% reflects very high exploitation activity. In practice, this vulnerability is often used as part of a post-exploitation chain where an attacker who has already gained initial access to the ASA through another vulnerability (such as CVE-2016-6366) uses CVE-2016-6367 to escalate privileges or establish persistent access.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2016-6367 and added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 14, 2022. The EPSS percentile of 95.8% indicates very high exploitation probability. This vulnerability was linked to the EPICBANANA exploit tool from the Equation Group toolset, which was leaked by the Shadow Brokers in August 2016. Public exploit code has been available since the leak, and the vulnerability has been used in targeted attacks against Cisco ASA devices, often in combination with the SNMP-based CVE-2016-6366 (EXTRABACON) vulnerability for complete compromise of the firewall appliance.
Remediation
- Apply Cisco security updates to upgrade the ASA software to a version that addresses CVE-2016-6367, as required by CISA's KEV catalog.
- Restrict CLI access to only authorized administrators using strong authentication, and implement role-based access control to limit which CLI commands each administrator can execute.
- Enable command authorization (aaa authorization command) to audit and restrict the CLI commands available to each user level.
- Monitor ASA system logs for unexpected CLI command executions, device crashes, or unusual administrative session activity that could indicate exploitation.
- Implement multi-factor authentication for all administrative access to ASA devices and ensure that management interfaces are accessible only through a dedicated, segmented management network.
Technical Details
CVE-2016-6367 resides in the CLI parser of Cisco ASA software. The parser fails to properly validate the length and content of input provided through certain CLI commands, classified under CWE-20 (Improper Input Validation). When an authenticated user with CLI access enters specially crafted commands, the input processing routine can overflow internal buffers or trigger unhandled conditions that lead to a device crash (DoS) or, in some cases, arbitrary code execution. The attack requires local CLI access, meaning the attacker must either have direct console access or an authenticated SSH/Telnet session to the ASA management interface. In the Equation Group toolset, the EPICBANANA exploit leveraged this vulnerability after initial access was gained through other means, using it to escalate privileges and modify the ASA's configuration for persistent access and traffic interception.
Frequently Asked Questions
Is CVE-2016-6367 being actively exploited?
Yes, CVE-2016-6367 has been actively exploited in targeted attacks. CISA has confirmed active exploitation and added it to the KEV catalog. The EPSS percentile of 95.8% reflects very high exploitation activity, driven by the EPICBANANA exploit tool from the Equation Group leak.
What products are affected by CVE-2016-6367?
CVE-2016-6367 affects Cisco Adaptive Security Appliance (ASA) software across multiple hardware platforms, including the ASA 5500 series and ASA 5500-X series running vulnerable software versions.
How do I fix CVE-2016-6367?
Apply the Cisco security update for the affected ASA software version. Additionally, restrict CLI access, implement command authorization, and deploy multi-factor authentication for administrative access. See the Remediation section for details.
How severe is CVE-2016-6367?
CVE-2016-6367 is a CLI input validation vulnerability with an EPSS percentile of 95.8%. While it requires authenticated local access, it can cause denial-of-service or code execution on enterprise firewall devices. Its use in combination with CVE-2016-6366 (EXTRABACON) in the Equation Group toolset demonstrates its role in complete firewall compromise scenarios.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.