CVE-2016-1287: Cisco ASA IKEv1/IKEv2 buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, public exploit code available, and very high EPSS probability make this an urgent perimeter fix.

What it is

Cisco ASA Software contains a buffer overflow in its IKEv1 and IKEv2 implementations, reachable via crafted UDP packets. It affects ASA 5500, 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module and ISA 3000 devices running the listed firmware versions. Because it is remotely reachable without authentication and can lead to code execution or device reload, it is a serious perimeter risk.

Impact

A remote attacker can execute arbitrary code on the affected appliance or force a denial of service via device reload. Code execution on an edge firewall or VPN concentrator can expose or bypass protected networks.

Attack surface

Reached over the network through IKEv1/IKEv2 UDP traffic; the CVSS vector shows no privileges and no user interaction required. Any host able to send IKE packets to the device can attempt it.

Exploitation

Public exploit code and technical descriptions exist (Exploit and Technical Description reference tags), and EPSS is 0.74795 (99.5th percentile), indicating high likelihood of exploitation. It is not listed in CISA KEV.

What to do

• Upgrade ASA Software to a fixed release (8.4(7.30), 8.7(1.18), 9.0(4.38), 9.1(7), 9.2(4.5), 9.3(3.7), 9.4(2.4), 9.5(2.2) or later) as applicable to your train.
• If immediate patching is not possible, restrict IKE UDP (500/4500) access to trusted peers only and disable IKE where it is not needed.
• Monitor Cisco advisory cisco-sa-20160210-asa-ike and vendor guidance for interim workarounds.
• Review exposure of ASA management and VPN interfaces to untrusted networks and segment them where feasible.

Detection

• Alert on unexpected ASA device reloads or crashes correlated with inbound IKE traffic.
• Monitor for anomalous or malformed IKEv1/IKEv2 packets to UDP 500/4500 from untrusted sources.
• Watch for signs of post-exploitation activity on ASA devices, such as unexpected configuration changes or new accounts.
• Use IDS/IPS signatures for the known public exploit against Cisco ASA IKE.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.