CVE-2016-6367

CVE-2016-6367 is a command injection flaw (CWE-77) in the command-line interface (CLI) parser of Cisco Adaptive Security Appliance (ASA) software. An authenticated, local attacker who submits crafted input to CLI commands can trigger the flaw, causing a denial-of-service condition on the appliance or, potentially, execution of arbitrary code. Successful code execution would give an attacker control over an ASA device, which typically sits at the network edge handling firewalling and VPN traffic. Any organization running affected Cisco ASA software is in scope; the source data does not specify affected or fixed version ranges, so administrators should consult Cisco's advisory for exact releases. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-05-24 (ransomware use unknown), and EPSS assigns a 22.6% probability of exploitation within 30 days (98th percentile), though no public proof-of-concept is known.

What to do: Apply Cisco's fixed ASA software releases per the vendor advisory, as required by CISA's KEV listing; because specific fixed versions are not provided in the source data, check Cisco's advisory for CVE-2016-6367 for the correct upgrade target. Until patched, restrict CLI access to trusted, authenticated administrators and watch for unexpected device reloads. Inventory all ASA appliances and verify none remain unpatched.