CVE-2008-4128
Cisco IOS Cross-Site Request Forgery Vulnerability
Description
CVE-2008-4128 is a set of cross-site request forgery (CSRF) vulnerabilities in the HTTP administration component of Cisco IOS 12.4 on the 871 Integrated Services Router. By tricking an authenticated administrator into visiting a malicious page or clicking a crafted link, a remote attacker can force the router to execute arbitrary commands through the privileged /level/15/exec/- and /level/15/exec/-/configure/http URIs. The CSRF vulnerability exploits the trust the router's web interface places in an already-authenticated administrator's browser, so no attacker credentials are needed — only that a logged-in administrator interacts with the malicious content. CISA has added CVE-2008-4128 to its Known Exploited Vulnerabilities (KEV) catalog, confirming this Cisco IOS vulnerability is being exploited in the wild, and public exploit code is available, making it an actively relevant risk for legacy Cisco IOS deployments.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | ios | 12.4 |
References
- http://jbrownsec.blogspot.com/2008/09/cisco-0day-released.html(Broken Link)
- http://www.securityfocus.com/bid/31218(Broken Link, Exploit, Third Party Advisory, VDB Entry)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45226(Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/6476(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/6477(Exploit, Third Party Advisory, VDB Entry)
- https://media.defense.gov/2026/Jul/09/2003959498/-1/-1/1/CSA_IMPROVE_ROUTER_HYGIENE.PDF(Third Party Advisory, US Government Resource)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-4128(US Government Resource)
- https://www.cisco.com/c/en/us/obsolete/ios-nx-os-software/cisco-ios-software-releases-12-4-mainline.html(Product)
Weakness Type
CWE-352: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery occurs when a web application does not sufficiently verify whether a request came from an authorized user or was forged by an attacker. In Cisco IOS 12.4's HTTP administration interface, the router accepts privileged command requests to its /level/15/exec/ URIs without a per-request anti-forgery token, so a victim administrator's authenticated browser can be coerced into submitting attacker-chosen commands.
Learn more: CWE-352 — Cross-Site Request Forgery (CSRF)
Impact Analysis
CVE-2008-4128 carries a CVSS 3.1 score of 4.3 (Medium) and is remotely exploitable over the network with low attack complexity and no authentication required of the attacker, but it does require user interaction — an authenticated administrator must be lured into triggering the forged request. Confidentiality (Low): the exploit can reveal privileged information such as output from a "show privilege" command via the /level/15/exec/- URI; integrity and availability are rated None in the CVSS metrics, and the scope is unchanged. While the individual CVSS impact is modest, the practical danger is higher because the vulnerable URIs run at IOS privilege level 15, meaning a forged request executes with full administrative authority on the router. Because routers are core network infrastructure, an attacker who lands a CSRF against an admin can alter device behavior, and the EPSS percentile of roughly 98% indicates this vulnerability is among the most likely to see exploitation activity.
Exploit Maturity
Public exploit code is available for CVE-2008-4128 via Exploit-DB (exploit 6476 and exploit 6477), and a VDB entry is catalogued at IBM X-Force. CISA has added CVE-2008-4128 to the Known Exploited Vulnerabilities catalog, confirming exploitation in the wild against Cisco IOS; ransomware usage is listed as unknown. The EPSS score of about 23.9% places this vulnerability in roughly the 98th percentile, indicating a high relative likelihood of exploitation activity, and its inclusion in guidance such as the "Improving Router Hygiene" advisory underscores that legacy Cisco routers remain an active target. Administrators of IOS 12.4 devices should treat this as an urgent item and disable or lock down the HTTP management interface now.
Remediation
- Follow CISA's KEV required action: apply mitigations in accordance with Cisco's vendor instructions, ensure compliance with BOD 26-04 patching guidance and CISA's Forensics Triage Requirements, and discontinue use of the product if mitigations are unavailable — the KEV due date is July 16, 2026.
- Disable the HTTP administration server on Cisco IOS 12.4 devices where it is not required (for example with "no ip http server" and "no ip http secure-server"), since the vulnerable /level/15/exec/ URIs are exposed through this component.
- Where web management is required, restrict it with access-control lists so only trusted management hosts can reach the HTTP interface, and consider migrating off the obsolete IOS 12.4 mainline release referenced in Cisco's product documentation.
- Mitigate the CSRF weakness in line with CWE-352 guidance: ensure administrators log out of the router's web interface when finished, avoid browsing untrusted sites in the same browser session used for router management, and use network segmentation to isolate management traffic.
- Monitor router logs and configuration for unexpected command execution or configuration changes, and review IOS command history and HTTP access logs for indicators of forged privilege-level-15 requests.
Technical Details
The vulnerability is a set of CSRF flaws (CWE-352) in the Cisco IOS 12.4 HTTP administration component: the web interface does not verify that privileged requests originated from a legitimate administrator action, so it processes any request that arrives with the victim's authenticated session. An attacker crafts a page or link that issues requests to /level/15/exec/- (for example a "show privilege" command) or /level/15/exec/-/configure/http (for example an "alias exec" command); when an authenticated administrator's browser loads the malicious content, it automatically sends the request with the administrator's credentials, causing the router to execute the attacker-chosen command. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects a network-reachable, low-complexity attack that needs no attacker privileges but does depend on user interaction, with a low confidentiality impact and unchanged scope. Because the abused URIs correspond to IOS privilege level 15, the forged commands run with the highest administrative authority even though the CSRF itself does not compromise the administrator's own credentials.
Frequently Asked Questions
Is CVE-2008-4128 being actively exploited?
Yes. CISA has added CVE-2008-4128 to its Known Exploited Vulnerabilities catalog, confirming exploitation in the wild against Cisco IOS, and public exploit code is available on Exploit-DB. Ransomware use is listed as unknown, but the EPSS percentile of about 98% signals a high relative likelihood of exploitation activity.
What products are affected by CVE-2008-4128?
The vulnerability affects the HTTP administration component of Cisco IOS 12.4, as observed on the Cisco 871 Integrated Services Router. Cisco IOS 12.4 mainline is now an obsolete release, so affected devices should be locked down or migrated off the vulnerable software.
How do I fix CVE-2008-4128?
Apply Cisco's mitigations in line with CISA's KEV required action and BOD 26-04 guidance, and meet the KEV due date of July 16, 2026. The most effective interim step is to disable the HTTP administration server ("no ip http server") or restrict it with access-control lists so only trusted management hosts can reach the vulnerable interface.
How severe is CVE-2008-4128?
CVE-2008-4128 is rated Medium with a CVSS 3.1 score of 4.3, driven by a low confidentiality impact and the requirement for administrator user interaction. However, the abused URIs run at IOS privilege level 15, and the EPSS score sits around the 98th percentile with confirmed KEV exploitation, so the real-world urgency is higher than the base score alone suggests.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.