CVE-2016-6367 Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution

What is CVE-2016-6367?

CVE-2016-6367 is a high-severity command injection vulnerability in Cisco Adaptive Security Appliance Software, published on 18 Aug 2016. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.

Weakness: CWE-77

Which versions are affected by CVE-2016-6367?

It affects 1 product.

Products include Cisco Adaptive Security Appliance Software.

How do I fix CVE-2016-6367?

No fix has been published for CVE-2016-6367 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 14 Jun 2022.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2016-6367 being exploited?

Yes. Attackers have exploited CVE-2016-6367 in the wild since at least 24 May 2022.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in Cisco Adaptive Security Appliance Software

• CVE-2025-20333 Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow Exploited Critical 9.9
• CVE-2016-6366 Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Exploited High 8.8
• CVE-2026-20349 Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Exploited High 8.6
• CVE-2024-20353 Cisco ASA and FTD Denial of Service Exploited High 8.6
• CVE-2020-3452 Cisco ASA and FTD Read-Only Path Traversal Exploited High 7.5

All Cisco Adaptive Security Appliance Software vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cxx8-9qq9-rm4x.