CVE-2016-6366
Cisco Adaptive Security Appliance (ASA) — Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability
Description
Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices allows remote authenticated users to execute arbitrary code via crafted IPv4 SNMP packets, aka Bug ID CSCva92151 or EXTRABACON.
Response & Mitigation
Why act now?
Prioritisation rationale
CVE-2016-6366 (EXTRABACON) was part of the Shadow Brokers leak and allows a remote, authenticated attacker — one who only needs valid SNMP credentials — to execute arbitrary code on the ASA, effectively achieving full compromise of the network perimeter. The EPSS score of 87.57 % (99.8th percentile) reflects the wide availability of weaponised exploit tooling. For NIS2-regulated operators and KRITIS organisations using Cisco ASA as a primary firewall or VPN gateway, the blast radius is severe: a compromised perimeter device grants lateral movement into all connected network segments. Although CISA has not flagged known ransomware campaign use, the CVSS vector and exploit maturity justify treating this as a critical-priority finding — patch deployment and SNMP hardening should pre-empt all other maintenance work on affected devices.
Runbook · Step 1
Immediate response (0-24 h)
- Apply the vendor patch immediately: Cisco has released fixes for all affected platforms (ASA 5500, 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, FWSM). Target versions are at minimum 9.1(7.13), 9.2(4.18), 9.4(3.12) or higher depending on your branch — verify the exact target version in Cisco Security Advisory CSCva92151 (EXTRABACON) and deploy without delay.
- Disable SNMP on all non-management interfaces: Until the patch is applied, run
no snmp-server enableor restrict SNMP strictly to a dedicated, isolated out-of-band management interface. - Restrict SNMP access to authorised NMS hosts only: Apply an ACL on the management interface blocking UDP/161 and UDP/162 from all sources except verified Network Management Station IPs.
- Enforce SNMPv3 with authentication and encryption: Disable SNMPv1 and SNMPv2c entirely. The vulnerability targets IPv4 SNMP packets; requiring SNMPv3
auth privforces an attacker to possess valid credentials before reaching the vulnerable code path. - Rotate all SNMP community strings: Change all v1/v2c community strings immediately and remove defaults (
public,private). - Review device logs for unexpected reloads and configuration changes: Check syslog for
%ASA-1-505013(reload events) and%ASA-5-111010(configuration changes from unexpected sources) as indicators of prior exploitation.
Runbook · Step 2
Mitigation layers
- Network segmentation: Route all SNMP management traffic (UDP/161, UDP/162) exclusively through a dedicated out-of-band management VLAN with no reachability from production networks or the internet.
- Enable IPS/IDS signatures: Activate Cisco IPS Signature 7648-0 (EXTRABACON) and Snort SIDs 39885/39886 on upstream intrusion prevention systems to detect and block known exploit payloads.
- Upstream firewall deny rules: If an upstream firewall exists in front of the ASA management IP, insert explicit deny rules for UDP/161 from all non-authorised source addresses.
- Least-privilege SNMP accounts: Restrict all SNMPv3 users to read-only; remove write community strings entirely to reduce the attack surface for authenticated adversaries.
- Configuration change monitoring: Use Cisco Security Manager or a SIEM with configuration-backup diffing to detect any unauthorised changes to the ASA running configuration in near-real-time.
Runbook · Step 3
Detection rules
- Syslog correlation: Alert on
%ASA-1-505013(unexpected reload) preceded by SNMP connections from non-authorised source IPs within a 5-minute window — SPL:index=network sourcetype=cisco:asa "%ASA-1-505013" | join [search sourcetype=cisco:asa "snmp" src_ip!=<authorized_nms_list>] - Network telemetry (Suricata): Flag oversized SNMP PDUs on UDP/161 as a buffer-overflow indicator:
alert udp any any -> $ASA_MGMT_IP 161 (msg:"CVE-2016-6366 SNMP oversized PDU"; dsize:>1472; sid:9016366; rev:1;) - Zeek connection logs: Alert on SNMP connections (udp/161) originating from IPs outside the authorised NMS whitelist — KQL:
NetworkEvents | where DestinationPort == 161 and Protocol == "UDP" and SourceIP !in (authorized_nms_ips) - SNMP error bursts in ASA syslog: A cluster of
%ASA-6-302015(SNMP connection established) events immediately followed by%ASA-3-210007(SNMP error) from the same source IP may indicate active exploitation attempts. - Configuration integrity checks: Run a daily hash comparison of the ASA running configuration (
show running-config) against a known-good baseline; escalate any deviation immediately.
Metrics
Public exploit references
Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.
References & sources
- http://www.securityfocus.com/bid/92521vdb-entryx_refsource_BID
- https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40258.zipx_refsource_MISC
- http://blogs.cisco.com/security/shadow-brokersx_refsource_CONFIRM
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-snmpvendor-advisoryx_refsource_CISCO
- http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516x_refsource_CONFIRM
- https://zerosum0x0.blogspot.com/2016/09/reverse-engineering-cisco-asa-for.htmlx_refsource_MISC
- https://www.exploit-db.com/exploits/40258/exploitx_refsource_EXPLOIT-DB
- http://www.securitytracker.com/id/1036637vdb-entryx_refsource_SECTRACK
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6366government-resource