CVE-2016-9225

CVE-2016-9225 describes a denial-of-service vulnerability in the Cisco Adaptive Security Appliance (ASA) CX Context-Aware Security module, affecting all versions. The flaw stems from improper handling of IP fragments, allowing an unauthenticated, remote attacker to exhaust packet buffers by sending crafted fragmented IP traffic. This results in the CX module being unable to process further traffic, causing a DoS condition. The vulnerability carries a high CVSS score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), indicating it can be exploited remotely with low complexity and no user interaction, leading to a complete loss of availability. Cisco has not and will not release patches or workarounds for this issue. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, consistent with the majority of reported vulnerabilities.