CVE-2008-4128 Cisco IOS CSRF Vulnerability Added to CISA KEV — Exploited by Russian FSB Center 16 (Static Tundra / Berserk Bear) in Ongoing Router-Hygiene Espionage Campaign

CVE-2008-4128 Cisco IOS CSRF Vulnerability Added to CISA KEV (TL-2026-1272), also tracked as Cisco IOS HTTP Admin CSRF, is a high-severity software vulnerability scored CVSS 9.3, first published 2026-07-13. It is attributed to Static Tundra (Russia) with high confidence, affects Cisco IOS, references 2 CVEs (CVE-2008-4128, CVE-2018-0171), maps to 18 MITRE ATT&CK techniques (T1005, T1020, T1040), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-1272

Threat ID
TL-2026-1272
Also known as
Cisco IOS HTTP Admin CSRF, Router Hygiene Campaign 2026
Severity
HIGH
CVSS
9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-13
Last reviewed
2026-07-13
Attribution
Static Tundra
Attribution confidence
HIGH
Nation-state nexus
Russia
Motivation
ESPIONAGE
Target sectors
defense industrial base, communications, energy, financial services, government administration, health, telecoms, higher education, manufacturing
Target regions
North America, Europe, Asia, Africa, ukraine
Detection rules
9
Indicators of compromise
15

Malware and tooling in CVE-2008-4128 Cisco IOS CSRF Vulnerability Added to CISA KEV

Malware and tooling: SYNful Knock - S0519, Shodan/Censys internet-wide scanning

CISA added the 2008 Cisco IOS HTTP administration CSRF flaw CVE-2008-4128 to its Known Exploited Vulnerabilities catalog on 2026-07-13 with a 2026-07-16 remediation deadline, citing active exploitation. The addition follows a joint US/allied (13-nation) cybersecurity advisory attributing exploitation of legacy Cisco device flaws — CVE-2008-4128 and CVE-2018-0171 — to Russian FSB Center 16, tracked as Static Tundra / Berserk Bear / Energetic Bear, which has run a decade-long espionage campaign against unpatched and end-of-life network infrastructure.

How CVE-2008-4128 Cisco IOS CSRF Vulnerability Added to CISA KEV works

CVE-2008-4128 is a set of cross-site request forgery (CSRF) vulnerabilities in the HTTP administration interface of Cisco IOS 12.4 on the 871 Integrated Services Router. The flaw allows a remote, unauthenticated attacker to trick an already-authenticated administrator's browser into issuing privileged commands — including a 'show privilege' request to the /level/15/exec/- URI and an 'alias exec' command to a related endpoint — resulting in arbitrary command execution at privilege level 15 without the victim's knowledge. Although originally disclosed and rated only CVSS v2 9.3 / CVSS v3.1 4.3 in 2008, CISA added it to the KEV catalog on 2026-07-13 (last-modified date on NVD also updated to 2026-07-13) with a compressed 2026-07-16 remediation deadline under BOD 26-04, confirming ongoing active exploitation against internet-facing legacy Cisco routers seventeen years after disclosure.

The re-emergence of this old vulnerability is directly tied to a joint international cybersecurity advisory (CISA/FBI/NSA plus 13 allied nations, published 2026-07-09, 'Improve Router Hygiene') attributing systematic scanning and exploitation of poorly hardened, end-of-life Cisco network devices to Russia's FSB Center 16, publicly tracked as Static Tundra (Cisco Talos), Berserk Bear / Energetic Bear / Crouching Yeti / Dragonfly / Ghost Blizzard (industry aliases). The advisory describes attackers scanning the internet for routers with default or weak credentials and exploiting known vulnerabilities — including this decade-plus-old Cisco Smart Install / HTTP admin flaw class alongside CVE-2018-0171 — to gain a persistent foothold on network infrastructure across the defense industrial base, communications, energy, financial services, government facilities, and healthcare sectors in 13+ countries. The group has been separately linked by CISA/FBI/NSA to a December 2025 attack on Poland's energy grid.

Static Tundra's broader tradecraft, documented by Cisco Talos and corroborated by the FBI (August 2025 advisory) and independent research, shows a mature campaign: attackers exploit Smart Install (TCP 4786) and web administration interfaces on unpatched/EOL Cisco IOS and IOS XE devices, force victim devices to upload startup/running configuration via TFTP, parse the stolen configs for Type 7 passwords, plaintext credentials and SNMP community strings, then use those credentials to pivot deeper into victim networks, create privilege-15 backdoor accounts, modify ACLs/TACACS+ configuration for defense evasion, and in some cases deploy the SYNful Knock firmware implant (first documented in 2015) for stealthy persistent access via crafted 'magic packets.' Given this pattern, CVE-2008-4128's KEV addition should be read as part of the same legacy-router exploitation toolkit rather than an isolated 2026 disclosure — the attackers deliberately target old, forgotten CVEs on devices organizations have failed to patch or decommission.

MITRE ATT&CK techniques used in TL-2026-1272

Collection

T1005 Data from Local System

Exfiltration

T1020 Automated Exfiltration; T1041 Exfiltration Over C2 Channel

credential-access

T1040 Network Sniffing

Discovery

T1046 Network Service Discovery

Execution

T1059 Command and Scripting Interpreter

Privilege Escalation

T1078 Valid Accounts

Command and Control

T1095 Non-Application Layer Protocol

persistence

T1098 Account Manipulation

Persistence

T1136 Create Account; T1505 Server Software Component; T1547 Boot or Logon Autostart Execution

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1498 Network Denial of Service

Credential Access

T1552 Unsecured Credentials

Reconnaissance

T1595 Active Scanning

defense-impairment

T1601 Modify System Image; T1685 Disable or Modify Tools

Affected products and versions in CVE-2008-4128 Cisco IOS CSRF Vulnerability Added to CISA KEV

  • Cisco — IOS
    Vulnerable versions: 12.4 on 871 Integrated Services Router
  • Cisco — IOS / IOS XE (Smart Install feature)
    Vulnerable versions: releases with Smart Install client enabled, pre-2018 patch, end-of-life devices
    Fixed in: releases addressed by Cisco Security Advisory cisco-sa-smi2-RSyz3AXf

Remediation for CVE-2008-4128 Cisco IOS CSRF Vulnerability Added to CISA KEV

Patches

  • No vendor patch exists for CVE-2008-4128 on end-of-life 871 ISR hardware — devices should be replaced or the HTTP admin server disabled
  • Apply Cisco fixed releases for CVE-2018-0171 (Smart Install RCE) per Cisco Security Advisory cisco-sa-smi2-RSyz3AXf

Immediate actions

  • Apply CISA BOD 26-04 mitigations and patch or replace affected Cisco IOS 871 ISR devices by the 2026-07-16 deadline
  • Disable the Cisco IOS/IOS XE HTTP/HTTPS administration server (`no ip http server`, `no ip http secure-server`) on any device where it is not strictly required
  • Disable Cisco Smart Install (`no vstack`) on all switches; Smart Install is not needed post zero-touch-provisioning
  • Restrict management-plane access (HTTP admin, Smart Install TCP/4786, SNMP, TACACS+) to trusted management networks via ACLs

Workarounds

  • Disable the IOS HTTP administration interface entirely if remote GUI management is not required
  • Anti-CSRF tokens are not available on this legacy platform — network-level access restriction is the only mitigation

Longer-term hardening

  • Discontinue use of end-of-life Cisco hardware (e.g., 871 ISR) that no longer receives security patches
  • Enforce strong, unique credentials and disable default/weak SNMP community strings and Type 7 password usage across network device fleets
  • Deploy network device configuration monitoring to detect unauthorized privilege-15 account creation, ACL/TACACS+ modification, and loopback interface changes
  • Adopt centralized, audited device configuration management with change-detection alerting for all network infrastructure

CVEs associated with CVE-2008-4128 Cisco IOS CSRF Vulnerability Added to CISA KEV

CVE-2008-4128, CVE-2018-0171

Weaknesses (CWE) in CVE-2008-4128 Cisco IOS CSRF Vulnerability Added to CISA KEV

CWE-352, CWE-121, CWE-798

Timeline of CVE-2008-4128 Cisco IOS CSRF Vulnerability Added to CISA KEV

  • CVE-2008-4128 (Cisco IOS 871 ISR HTTP admin CSRF) publicly disclosed and published to NVD with initial CVSSv2 score 9.3.
  • SYNful Knock Cisco IOS firmware implant, later associated with the same actor cluster, publicly documented by FireEye/Mandiant.
  • Cisco discloses and patches CVE-2018-0171 (Smart Install RCE), the companion legacy flaw exploited in the same 2026 campaign.
  • Static Tundra begins aggressive, sustained exploitation of unpatched CVE-2018-0171 on end-of-life network devices, per Cisco Talos and FBI reporting.
  • FBI publishes advisory attributing exploitation of legacy Cisco device vulnerabilities to Russia's FSB-linked Static Tundra group.
  • CISA/FBI/NSA attribute an attack on Poland's energy grid to the same Russian FSB Center 16 actor cluster.
  • CISA, FBI, NSA and 13 allied nations publish the joint 'Improve Router Hygiene' cybersecurity advisory detailing ongoing FSB Center 16 exploitation of end-of-life Cisco network devices, including CVE-2008-4128 and CVE-2018-0171.
  • CISA adds CVE-2008-4128 to the Known Exploited Vulnerabilities catalog, confirming active exploitation seventeen years after original disclosure, with a compressed remediation deadline.
  • CISA BOD 26-04 remediation deadline for federal agencies to mitigate or replace affected Cisco 871 ISR devices.

Sources cited for CVE-2008-4128 Cisco IOS CSRF Vulnerability Added to CISA KEV

Threats related to CVE-2008-4128 Cisco IOS CSRF Vulnerability Added to CISA KEV

Detection coverage for TL-2026-1272

As of 2026-07-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1272 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1272

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats