CVE-2016-6366VulnerabilityPublished 05/24/2022Updated 10/24/2026

CVE-2016-6366: Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability

Affects Cisco Adaptive Security Appliance (ASA)Source CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 05/24/2022
KEV deadline: 06/14/2022
EPSS: 87.6% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2016-6366 (opens in a new tab)

Description

CVE-2016-6366 is a high-severity buffer overflow vulnerability in the SNMP code of Cisco Adaptive Security Appliance (ASA) software. Exploitation of this flaw could allow an attacker to cause the affected device to reload or execute arbitrary code remotely. This vulnerability has been observed exploited in the wild. No specific affected versions or patch information is provided in the input data.

Summary

This vulnerability involves a buffer overflow in the SNMP implementation of Cisco ASA software. An attacker exploiting this flaw could trigger a reload of the device or remotely execute code, potentially gaining control over the system. The vulnerability is tracked as CVE-2016-6366 and is associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). It has been reported as exploited in the wild, indicating active threat activity.

Impact

Successful exploitation can lead to denial of service via device reload or remote code execution, which could compromise the confidentiality, integrity, and availability of the affected Cisco ASA device.

Mitigation

Patch status is not yet confirmed — check the Cisco vendor advisory for current remediation guidance. Until a patch is applied, restrict SNMP access to trusted management networks and monitor for suspicious SNMP traffic targeting the ASA device.

Weaknesses

CWE-119Buffer Errors (Memory Bounds) (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:42:11 UTC

Weaknesses

References

Related threats