{"id":"CVE-2016-6367","kind":"vulnerability","aliases":["CVE-2016-6367"],"related":[],"title":"Cisco Adaptive Security Appliance (ASA): Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability","description":"A vulnerability in the command-line interface (CLI) parser of Cisco ASA software could allow an authenticated, local attacker to create a denial-of-service (DoS) condition or potentially execute code.\n\nCISA required action: Apply updates per vendor instructions.","summary":"A flaw in the command-line parser of Cisco ASA firewall software lets an attacker who already has CLI access crash the device or possibly run code on it. CISA lists it as exploited in the wild.","severity":"high","cvss":7.8,"epss":0.22583,"exploited":true,"exploited_at":"2022-05-24T00:00:00+00:00","products":[{"name":"Cisco Adaptive Security Appliance (ASA)","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["asa","cisco","exploited","firewall","infrastructure","self-hosted"],"not_affected_if":["no-asa-appliances","no-cli-admin-accounts"],"how_to_check":"Run 'show version' on each ASA and compare against the fixed release in Cisco's advisory; unknown whether the sources give a specific command beyond that.","fix":"Apply the update per Cisco's vendor instructions (as CISA requires); exact fixed version: unknown.","status":"open","published_at":"2016-08-18T18:59:01+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:15:57+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:15:57Z","model":"claude-haiku-5-5","output":{"fix":"Apply the update per Cisco's vendor instructions (as CISA requires); exact fixed version: unknown.","reach":"local","impact":"high","summary":"A flaw in the command-line parser of Cisco ASA firewall software lets an attacker who already has CLI access crash the device or possibly run code on it. CISA lists it as exploited in the wild.","category":"infrastructure","who_cares":["cisco","asa","self-hosted","firewall"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker with CLI access could crash the firewall or execute code on it","analyst_note":"Find the Cisco advisory and the fixed ASA versions; confirm whether the flaw needs only low-privilege CLI login or a particular configuration, via the CISA KEV entry and Cisco's security advisories.","how_to_check":"Run 'show version' on each ASA and compare against the fixed release in Cisco's advisory; unknown whether the sources give a specific command beyond that.","needs_analyst":true,"not_affected_if":["no-asa-appliances","no-cli-admin-accounts"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000498,"input_tokens":2882,"output_tokens":419,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2016':17A,20A '-6367':18A,21A 'access':55B 'action':108C 'adapt':2A,7A 'adaptive':23A 'allow':88C 'alreadi':52B 'appli':109C 'applianc':4A,9A 'appliance':25A 'asa':5A,10A,26A,27B,45B,85C 'attack':50B,92C 'authent':90C 'cisa':65B,106C 'cisco':1A,6A,22A,28B,44B,84C 'cli':11A,54B,81C 'code':13A,62B,105C 'command':40B,78C 'command-lin':39B,77C 'condit':101C 'could':87C 'crash':56B 'creat':94C 'cve':16A,19A 'denial':97C 'denial-of-servic':96C 'devic':58B 'dos':100C 'execut':14A,104C 'exploit':29B,69B 'firewal':30B,46B 'flaw':36B 'host':34B 'infrastructur':31B 'instruct':113C 'interfac':80C 'let':48B 'line':41B,79C 'list':66B 'local':91C 'parser':42B,82C 'per':111C 'possibl':60B 'potenti':103C 'remot':12A 'requir':107C 'run':61B 'secur':3A,8A 'security':24A 'self':33B 'self-host':32B 'servic':99C 'softwar':47B,86C 'updat':110C 'vendor':112C 'vulner':15A,74C 'wild':72B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2016-08-18T18:59:01+00:00","kev":{"dateAdded":"2022-05-24","dueDate":"2022-06-14","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2016-6367","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-6367","severity":null,"published_at":"2022-05-24T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:06+00:00","note":null},{"source":"epss","external_id":"CVE-2016-6367","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-6367","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2016-6367","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6367","severity":null,"published_at":"2016-08-18T18:59:01+00:00","modified_at":"2026-06-17T00:50:54+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}