Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability

HIGH 7.8EXPLOITED (CISA KEV)CVE-2016-6367 · Published 18/08/2016 · updated 17/06/2026

Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 24/05/2022. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
Adaptive Security Appliance (ASA) Cisco	Versions not published yet (product named by CISA KEV)

Description

Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.

References

blogs.cisco.com/security/shadow-brokers · Exploit
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-cli · Vendor Advisory
tools.cisco.com/security/center/viewErp.x · Vendor Advisory
securityfocus.com/bid/92520 · Broken Link
securitytracker.com/id/1036636 · Broken Link
offensive-security/exploit-database-bin-sploits · Broken Link
exploit-db.com/exploits/40271 · Third Party Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2016-6367

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free