CVE-2008-4128

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2008-4128 4.3

Cisco · IOS · Added 2026-07-13 · Published 2008-09-18

3-Day Required KEV Active Exploitation

Details

VulnerabilityCisco IOS Cross-Site Request Forgery Vulnerability

VendorCisco

ProductIOS

Date added2026-07-13

Due date2026-07-16

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-352

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Descriptions

KEV: Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI.

NVD: Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI. NOTE: some of these details are obtained from third party information.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-07-14 07:34 UTC

Wall time0.5s

Searches1

Component defaultunknown

Sources https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory?cve=CVE-2008-4128
https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a
https://www.cisa.gov/news-events/alerts/2026/07/13/cisa-adds-one-known-exploited-vulnerability-catalog
https://github.com/advisories/GHSA-6977-wjv6-r929
https://securityaffairs.com/195262/security/u-s-cisa-adds-a-cisco-ios-flaw-to-its-known-exploited-vulnerabilities-catalog.html
https://www.cve.org/CVERecord?id=CVE-2008-4128
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/https/configuration/xe-16/https-xe-16-book.pdf

Hunting hypothesis agent

Monitor for unauthenticated network-based attempts to forge cross-site requests in the HTTP Administration component of IOS — requiring user interaction.

Research details

ComponentHTTP Administration

PreconditionsNetwork reachability to the affected interface or service — no authentication barrier; User on the target system must perform an action (click, confirm, visit a URL) for the exploit to succeed; Target must run IOS with the HTTP Administration component accessible agent

Public PoCno

Advisoryhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory?cve=CVE-2008-4128

Exploit notesCVSS attack complexity: LOW

SummaryCisco IOS (HTTP Administration) | No public PoC identified in this cycle | Vendor advisory located | CISA AA26-194A attributes exploitation to Russian state actors

Tia coverage

First reported2026-07-14

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

fsb-center-16-router-targeting-campaign-13-nation-joint-advisory

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.