CVE-2016-6366: Cisco ASA SNMP buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is a remotely reachable pre-auth-adjacent buffer overflow on perimeter security appliances, is listed in CISA KEV, and has a very high EPSS score with public exploit code.

What it is

Cisco ASA, PIX and FWSM software through 9.4.2.3 contains a classic buffer overflow (CWE-120) reachable through crafted IPv4 SNMP packets. A remote authenticated user can trigger it to run arbitrary code on the device, which is a network security appliance sitting on the perimeter. The flaw is publicly known as EXTRABACON and is listed in CISA's Known Exploited Vulnerabilities catalog.

Impact

Successful exploitation gives the attacker arbitrary code execution on the ASA with the privileges of the affected SNMP service, allowing full compromise of the appliance and any traffic or credentials it handles. Because the device is a perimeter firewall/VPN concentrator, that access can be used to pivot into protected networks.

Attack surface

Reachable over the network via IPv4 SNMP packets sent to the device; the CVSS vector (AV:N/PR:L/UI:N) indicates the attacker must be authenticated but no user interaction is required. SNMP access must be enabled and reachable for the crafted packets to be processed.

Exploitation

The vulnerability is in CISA KEV (added 2022-05-24) and has an EPSS 30-day probability of 0.876 (99.7th percentile), indicating active exploitation is expected. Multiple references are tagged Exploit, including public exploit code and a technical reverse-engineering writeup.

What to do

• Upgrade ASA/PIX/FWSM software to a fixed release per the Cisco advisory cisco-sa-20160817-asa-snmp; this is the only complete fix.
• If patching cannot be done immediately, disable SNMP on the affected devices or restrict SNMP access to trusted management hosts only.
• Replace SNMPv1/v2c with SNMPv3 and strong credentials where SNMP must remain enabled.
• Segment and firewall management interfaces so SNMP is not reachable from untrusted networks.
• Monitor Cisco advisories and CISA KEV for updated guidance and verify the fixed version is actually running after upgrade.

Detection

• Alert on SNMP traffic to ASA/PIX/FWSM management addresses from hosts outside the approved management subnet.
• Inspect device logs and SNMP service logs for malformed or oversized SNMP requests and unexpected process crashes or reloads.
• Hunt for unexpected configuration changes, new local accounts, or anomalous outbound connections originating from the firewall appliance.
• Correlate ASA syslog events with known EXTRABACON exploitation indicators and review for repeated failed SNMP authentication attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.