CVE-2016-6366

Severity CVSS v4.0:

Pending analysis

Type:

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Publication date:

18/08/2016

Last modified:

12/04/2025

Description

Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices allows remote authenticated users to execute arbitrary code via crafted IPv4 SNMP packets, aka Bug ID CSCva92151 or EXTRABACON.

Impact

Vector 3.x

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS v3.1 Severity and Metrics:

Base Score: 8.80 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): High
Availability (A): High

Base Score 3.x

8.80

Severity 3.x

HIGH

Vector 2.0

AV:N/AC:M/Au:S/C:C/I:C/A:C CVSS v2.0 Severity and Metrics:

Base Score: 8.50 HIGH
Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C

Attack Vector (AV): Network
Attack Complexity (AC): Medium
Authentication (Au): Single
Confidentiality (C): Complete
Integrity (I): Complete
Availability (A): Complete

Base Score 2.0

8.50

Severity 2.0

HIGH

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:o:cisco:pix_firewall_software:-:::::::*
cpe:2.3:h:cisco:pix_firewall_501:-:::::::*
cpe:2.3:h:cisco:pix_firewall_506:-:::::::*
cpe:2.3:h:cisco:pix_firewall_506e:-:::::::*
cpe:2.3:h:cisco:pix_firewall_515:-:::::::*
cpe:2.3:h:cisco:pix_firewall_515e:-:::::::*
cpe:2.3:h:cisco:pix_firewall_520:-:::::::*
cpe:2.3:h:cisco:pix_firewall_525:-:::::::*
cpe:2.3:h:cisco:pix_firewall_535:-:::::::*
cpe:2.3:o:cisco:adaptive_security_appliance_software::::::::	7.2.1 (including)	9.0.4.40 (excluding)
cpe:2.3:o:cisco:adaptive_security_appliance_software::::::::	9.1.1 (including)	9.1.7\(9\) (excluding)
cpe:2.3:o:cisco:adaptive_security_appliance_software::::::::	9.2.0 (including)	9.2.4\(14\) (excluding)
cpe:2.3:o:cisco:adaptive_security_appliance_software::::::::	9.3.0 (including)	9.3.3\(10\) (excluding)
cpe:2.3:o:cisco:adaptive_security_appliance_software::::::::	9.4.0.115 (including)	9.4.3\(8\) (excluding)
cpe:2.3:o:cisco:adaptive_security_appliance_software::::::::	9.5.0 (including)	9.5\(3\) (including)

To consult the complete list of CPE names with products and versions, see this page

CVE-2016-6366

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools