Read the docs
TI-2016-07553 Aliases CVE-2016-9225GHSA-847f-22gw-x6h3

Resource management flaw in all versions of the ASA CX Context-Aware Security module

Priority MEDIUM 42CWE-399Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-399 and the CVSS impact.

Summary

A vulnerability in the data plane IP fragment handler of the Cisco Adaptive Security Appliance (ASA) CX Context-Aware Security module could allow an unauthenticated, remote attacker to cause the CX module to be unable to process further traffic, resulting in a denial of service (DoS) condition. The vulnerability is due to improper handling of IP fragments. An attacker could exploit this vulnerability by sending crafted fragmented IP traffic across the CX module. An exploit could allow the attacker to exhaust free packet buffers in shared memory (SHM), causing the CX module to be unable to process further traffic, resulting in a DoS condition. This vulnerability affects all versions of the ASA CX Context-Aware Security module. Cisco has not released and will not release software updates that address this vulnerability. There are no workarounds that address this vulnerability. Cisco Bug IDs: CSCva62946.

Why it matters now

EPSS 0.02662 85th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—all versions of the ASA CX Context-Aware Security moduleall versions of the ASA CX Context-Aware Security module—No fix listedCNA
  • all versions of the ASA CX Context-Aware Security module Vendor— Affected all versions of the ASA CX Context-Aware Security module Fixed in — No fix listed CNA

CPE configurations NVD · 24

CPEVersionsRoleVendor
cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.0.1:*:*:*:*:*:*:*9.0.1VulnerableCisco
cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.0.1-40:*:*:*:*:*:*:*9.0.1-40VulnerableCisco
cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.0.2:*:*:*:*:*:*:*9.0.2VulnerableCisco
cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.0.2-68:*:*:*:*:*:*:*9.0.2-68VulnerableCisco
cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.0_base:*:*:*:*:*:*:*9.0_baseVulnerableCisco
cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.1.2-29:*:*:*:*:*:*:*9.1.2-29VulnerableCisco
cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.1.2-42:*:*:*:*:*:*:*9.1.2-42VulnerableCisco
cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.1.3-8:*:*:*:*:*:*:*9.1.3-8VulnerableCisco
cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.1.3-10:*:*:*:*:*:*:*9.1.3-10VulnerableCisco
cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.1.3-13:*:*:*:*:*:*:*9.1.3-13VulnerableCisco
  • cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.0.1:*:*:*:*:*:*:* Versions 9.0.1 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.0.1-40:*:*:*:*:*:*:* Versions 9.0.1-40 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.0.2:*:*:*:*:*:*:* Versions 9.0.2 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.0.2-68:*:*:*:*:*:*:* Versions 9.0.2-68 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.0_base:*:*:*:*:*:*:* Versions 9.0_base Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.1.2-29:*:*:*:*:*:*:* Versions 9.1.2-29 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.1.2-42:*:*:*:*:*:*:* Versions 9.1.2-42 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.1.3-8:*:*:*:*:*:*:* Versions 9.1.3-8 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.1.3-10:*:*:*:*:*:*:* Versions 9.1.3-10 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.1.3-13:*:*:*:*:*:*:* Versions 9.1.3-13 Vulnerable ·Cisco
Show 14 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.2.1-1:*:*:*:*:*:*:*9.2.1-1VulnerableCisco
cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.2.2-1:*:*:*:*:*:*:*9.2.2-1VulnerableCisco
cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.3\(1.1.112\):*:*:*:*:*:*:*9.3(1.1.112)VulnerableCisco
cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.3.1-1:*:*:*:*:*:*:*9.3.1-1VulnerableCisco
cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.3.2-1:*:*:*:*:*:*:*9.3.2-1VulnerableCisco
cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.3.3.1-13:*:*:*:*:*:*:*9.3.3.1-13VulnerableCisco
cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.3.4-1:*:*:*:*:*:*:*9.3.4-1VulnerableCisco
cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.3.4-2:*:*:*:*:*:*:*9.3.4-2VulnerableCisco
cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.3.4-3:*:*:*:*:*:*:*9.3.4-3VulnerableCisco
cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.3.4-4:*:*:*:*:*:*:*9.3.4-4VulnerableCisco
cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.3.4-5:*:*:*:*:*:*:*9.3.4-5VulnerableCisco
cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.3.4-6:*:*:*:*:*:*:*9.3.4-6VulnerableCisco
cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.3.4.1.11:*:*:*:*:*:*:*9.3.4.1.11VulnerableCisco
cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.3_base:*:*:*:*:*:*:*9.3_baseVulnerableCisco
  • cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.2.1-1:*:*:*:*:*:*:* Versions 9.2.1-1 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.2.2-1:*:*:*:*:*:*:* Versions 9.2.2-1 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.3\(1.1.112\):*:*:*:*:*:*:* Versions 9.3(1.1.112) Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.3.1-1:*:*:*:*:*:*:* Versions 9.3.1-1 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.3.2-1:*:*:*:*:*:*:* Versions 9.3.2-1 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.3.3.1-13:*:*:*:*:*:*:* Versions 9.3.3.1-13 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.3.4-1:*:*:*:*:*:*:* Versions 9.3.4-1 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.3.4-2:*:*:*:*:*:*:* Versions 9.3.4-2 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.3.4-3:*:*:*:*:*:*:* Versions 9.3.4-3 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.3.4-4:*:*:*:*:*:*:* Versions 9.3.4-4 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.3.4-5:*:*:*:*:*:*:* Versions 9.3.4-5 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.3.4-6:*:*:*:*:*:*:* Versions 9.3.4-6 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.3.4.1.11:*:*:*:*:*:*:* Versions 9.3.4.1.11 Vulnerable ·Cisco
  • cpe:2.3:o:cisco:asa_cx_context-aware_security_software:9.3_base:*:*:*:*:*:*:* Versions 9.3_base Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-9225
  2. 2026-10-03 Alias added: GHSA-847f-22gw-x6h3

References

Advisory 1

  • TI-2016-01193 The RBAC implementation in Cisco ASA-CX Content-Aware Security software before… CVSS 3.0HIGH 8.8
  • TI-2015-00629 The virtualization layer in Cisco ASA FirePOWER Software before 5.3.1.2 and 5.4.x before… CVSS 2.0HIGH 7.8
  • TI-2013-01048 Cisco ASA CX Context-Aware Security Software allows remote attackers to cause a denial of… CVSS 2.0MEDIUM 5.4
  • TI-2015-05328 The web-based GUI in Cisco Adaptive Security Appliance (ASA) CX Context-Aware Security… CVSS 2.0MEDIUM 4.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences