Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X…
Priority CRITICAL 93Exploited in the wildCWE-77Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-77.
Summary
Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.
Why it matters now
Exploitation Active In CISA KEV since 2022-05-24CISA due date 2022-06-14
EPSS 0.22583 97th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 30
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* | 7.2.0 to before 8.4\(3\); 8.5 to before 9.0\(1\) | Vulnerable | Cisco |
| cpe:2.3:h:cisco:asa_5500:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asa_5500-x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asa_5500_csc-ssm:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asa_5505:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asa_5506-x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asa_5506h-x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asa_5506w-x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asa_5508-x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asa_5510:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
- cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* Versions 7.2.0 to before 8.4\(3\); 8.5 to before 9.0\(1\) Vulnerable ·Cisco
- cpe:2.3:h:cisco:asa_5500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asa_5500-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asa_5500_csc-ssm:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asa_5505:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asa_5506-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asa_5506h-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asa_5506w-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asa_5508-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asa_5510:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
Show 20 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:cisco:asa_5512-x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asa_5515-x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asa_5516-x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asa_5520:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asa_5525-x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asa_5540:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asa_5545-x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asa_5550:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asa_5555-x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asa_5580:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:asa_5585-x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:firewall_services_module:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:pix_firewall_501:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:pix_firewall_506:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:pix_firewall_506e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:pix_firewall_515:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:pix_firewall_515e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:pix_firewall_520:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:pix_firewall_525:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:pix_firewall_535:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
- cpe:2.3:h:cisco:asa_5512-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asa_5515-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asa_5516-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asa_5520:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asa_5525-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asa_5540:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asa_5545-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asa_5550:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asa_5555-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asa_5580:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:asa_5585-x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:firewall_services_module:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:pix_firewall_501:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:pix_firewall_506:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:pix_firewall_506e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:pix_firewall_515:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:pix_firewall_515e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:pix_firewall_520:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:pix_firewall_525:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:pix_firewall_535:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2022-05-24 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2016-6367
- 2026-10-03 Alias added: GHSA-cxx8-9qq9-rm4x
References
Exploit 3
More Cisco Adaptive Security Appliance Software vulnerabilities
- TI-2025-14628 Buffer overflow in Cisco Secure Firewall Adaptive Security Appliance Software KEVCVSS 3.1CRITICAL 9.9
- TI-2016-05454 Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on… KEVCVSS 3.1HIGH 8.8
- TI-2023-06973 Authentication bypass in Cisco Adaptive Security Appliance Software KEVCVSS 3.1CRITICAL 9.1
- TI-2026-82192 Denial of service in Cisco Secure Firewall ASA and FTD SSL VPN KEVCVSS 3.1HIGH 8.6
- TI-2026-16533 Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense… KEVCVSS 3.1HIGH 8.6
- TI-2025-14657 Missing authorization in Cisco Secure Firewall Adaptive Security Appliance Software KEVCVSS 3.1HIGH 8.6
Sources
- CVE-2016-6367 · CVE Program
- CVE-2016-6367 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-cxx8-9qq9-rm4x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences