Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain pr…

published 2016-08-18 10 y ago modified 2026-06-17 4 mo ago also EUVD-2016-7290

cvss: 7.8; version 3.1, CNA
cisa kev: Exploited; added 2022-05-24
epss: 22.6%; EPSS 22.6% chance of exploitation in 30 days, percentile 97%
public exploits: 1; Exploit-DB

Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.

Patch / fix

cisa required action Apply updates per vendor instructions.

fixed in 1

cisco adaptive_security_appliance_software 8.4\(3\), 9.0\(1\)

Timeline

2016-08-15 Found exploited as a 0-day (Project Zero)
2016-08-17 0-day patched (Project Zero)
2016-08-18 Published
2016-08-19 First public exploit (EDB-40271)
2022-05-24 Added to CISA KEV
2022-06-14 CISA patch deadline
2024-11-08 CISA SSVC: exploitation active

Known exploited

Added: 4 y ago (2022-05-24)
Patch by: 2022-06-14 (4 y ago)
Ransomware: Not known
Required action: Apply updates per vendor instructions.
Vendor, product: Cisco, Adaptive Security Appliance (ASA)
CISA name: Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability

Zero-day

Detected in real attacks while still unknown to the vendor and the public, per Google Project Zero's 0day In-the-Wild tracker.

Found: 2016-08-15
Patched: 2016-08-17
Details: project zero tracker

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: no
Technical impact: total
Assessed: 1 y ago (2024-11-08)

Exploit prediction

22.58% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-40271 Cisco ASA / PIX - 'EPICBANANA' Local Privilege Escalation local, 2016-08-19
blogs.cisco.com http://blogs.cisco.com/security/shadow-brokers referenced PoC, tagged "exploit" by a source, unverified
github.com https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40271.zip referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	6.8	AV:L/AC:L/Au:S/C:C/I:C/A:C

Classification

Weakness

CWE-77 Improper Neutralization of Special Elements used in a Command

References

exploit-db.com /exploits/40271/
exploit, third-party-advisory, vdb-entry
blogs.cisco.com /security/shadow-brokers
exploit, press/media-coverage, vendor-advisory
github.com /offensive-security/exploit-database-bin-sploits/raw/master/sploits/40271.zip
broken-link, exploit
tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-cli
vendor-advisory
tools.cisco.com /security/center/viewErp.x?alertId=ERP-56516
vendor-advisory
securitytracker.com /id/1036636
vdb-entry, broken-link, third-party-advisory
securityfocus.com /bid/92520
vdb-entry, broken-link, third-party-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6367
government-resource, us-government-resource

Sources

CVE List CVE-2016-6367
NVD CVE-2016-6367

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary