CVE-2016-6416

Summary

CVE	CVE-2016-6416
State	PUBLISHED
Assigner	cisco
Source Priority	CVE Program / NVD first with legacy fallback
Published	2016-10-05 17:59:05 UTC
Updated	2026-05-06 22:30:45 UTC
Description	The FTP service in Cisco AsyncOS on Email Security Appliance (ESA) devices 9.6.0-000 through 9.9.6-026, Web Security Appliance (WSA) devices 9.0.0-162 through 9.5.0-444, and Content Security Management Appliance (SMA) devices allows remote attackers to cause a denial of service via a flood of FTP traffic, aka Bug IDs CSCuz82907, CSCuz84330, and CSCuz86065.

Primary CVSS: v3.0 5.9 MEDIUM from [email protected]

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.008880000 probability, percentile 0.756020000 (date 2026-05-07)

Problem Types: CWE-119 | n/a

Version	Source	Type	Score	Severity	Vector
3.0	[email protected]	Primary	5.9	MEDIUM	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H`
2.0	[email protected]	Primary	4.3		`AV:N/AC:M/Au:N/C:N/I:N/A:P`

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Access Vector

Network

Access Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

AV:N/AC:M/Au:N/C:N/I:N/A:P

Type	Vendor	Product	Version	Update	Edition	Language
Application	Cisco	Content Security Management Appliance	9.1.0	All	All	All
Application	Cisco	Content Security Management Appliance	9.1.0-004	All	All	All
Application	Cisco	Content Security Management Appliance	9.1.0-031	All	All	All
Application	Cisco	Content Security Management Appliance	9.1.0-033	All	All	All
Application	Cisco	Content Security Management Appliance	9.1.0-103	All	All	All
Application	Cisco	Content Security Management Appliance	9.5.0	All	All	All
Application	Cisco	Content Security Management Appliance	9.6.0	All	All	All
Application	Cisco	Email Security Appliance	9.6.0-000	All	All	All
Application	Cisco	Email Security Appliance	9.6.0-042	All	All	All
Application	Cisco	Email Security Appliance	9.6.0-051	All	All	All
Application	Cisco	Email Security Appliance	9.7.1-066	All	All	All
Application	Cisco	Email Security Appliance	9.9.6-026	All	All	All
Application	Cisco	Email Security Appliance	9.9_base	All	All	All
Application	Cisco	Web Security Appliance	9.0.0-162	All	All	All
Application	Cisco	Web Security Appliance	9.1.0-000	All	All	All
Application	Cisco	Web Security Appliance	9.1.0-070	All	All	All
Application	Cisco	Web Security Appliance	9.1_base	All	All	All
Application	Cisco	Web Security Appliance	9.5.0-235	All	All	All
Application	Cisco	Web Security Appliance	9.5.0-284	All	All	All
Application	Cisco	Web Security Appliance	9.5.0-444	All	All	All
Application	Cisco	Web Security Appliance	9.5_base	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	Na	N/a	affected n/a	Not specified

Reference	Source	Link	Tags
Cisco Email Security Appliance AsyncOS Lack of FTP Throttling Lets Remote Users Deny Service - SecurityTracker	af854a3a-2127-422b-91ae-364da2661108	www.securitytracker.com
Cisco Web Security Appliance AsyncOS Lack of FTP Throttling Lets Remote Users Deny Service - SecurityTracker	af854a3a-2127-422b-91ae-364da2661108	www.securitytracker.com
Cisco Content Security Management Appliance AsyncOS Lack of FTP Throttling Lets Remote Users Deny Service - SecurityTracker	af854a3a-2127-422b-91ae-364da2661108	www.securitytracker.com
Cisco AsyncOS File Transfer Protocol Denial of Service Vulnerability	af854a3a-2127-422b-91ae-364da2661108	tools.cisco.com	Vendor Advisory
Multiple Cisco Products CVE-2016-6416 Denial of Service Vulnerability	af854a3a-2127-422b-91ae-364da2661108	www.securityfocus.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.