# CVE-2008-4128 Cisco IOS CSRF Vulnerability Added to CISA KEV — Exploited by Russian FSB Center 16 (Static Tundra / Berserk Bear) in Ongoing Router-Hygiene Espionage Campaign

> CISA added the 2008 Cisco IOS HTTP administration CSRF flaw CVE-2008-4128 to its Known Exploited Vulnerabilities catalog on 2026-07-13 with a 2026-07-16 remediation deadline, citing active exploitation. The addition follows a joint US/allied (13-nation) cybersecurity advisory attributing exploitation of legacy Cisco device flaws — CVE-2008-4128 and CVE-2018-0171 — to Russian FSB Center 16, tracked as Static Tundra / Berserk Bear / Energetic Bear, which has run a decade-long espionage campaign against unpatched and end-of-life network infrastructure.

- **Published:** 2026-07-13T00:00:00Z
- **Last reviewed:** 2026-07-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1272
- **ID:** TL-2026-1272
- **Severity:** HIGH (CVSS 9.3)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Static Tundra (Russia)
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2008-4128, CVE-2018-0171

## Description

CVE-2008-4128 is a set of cross-site request forgery (CSRF) vulnerabilities in the HTTP administration interface of Cisco IOS 12.4 on the 871 Integrated Services Router. The flaw allows a remote, unauthenticated attacker to trick an already-authenticated administrator's browser into issuing privileged commands — including a 'show privilege' request to the /level/15/exec/- URI and an 'alias exec' command to a related endpoint — resulting in arbitrary command execution at privilege level 15 without the victim's knowledge. Although originally disclosed and rated only CVSS v2 9.3 / CVSS v3.1 4.3 in 2008, CISA added it to the KEV catalog on 2026-07-13 (last-modified date on NVD also updated to 2026-07-13) with a compressed 2026-07-16 remediation deadline under BOD 26-04, confirming ongoing active exploitation against internet-facing legacy Cisco routers seventeen years after disclosure.

The re-emergence of this old vulnerability is directly tied to a joint international cybersecurity advisory (CISA/FBI/NSA plus 13 allied nations, published 2026-07-09, 'Improve Router Hygiene') attributing systematic scanning and exploitation of poorly hardened, end-of-life Cisco network devices to Russia's FSB Center 16, publicly tracked as Static Tundra (Cisco Talos), Berserk Bear / Energetic Bear / Crouching Yeti / Dragonfly / Ghost Blizzard (industry aliases). The advisory describes attackers scanning the internet for routers with default or weak credentials and exploiting known vulnerabilities — including this decade-plus-old Cisco Smart Install / HTTP admin flaw class alongside CVE-2018-0171 — to gain a persistent foothold on network infrastructure across the defense industrial base, communications, energy, financial services, government facilities, and healthcare sectors in 13+ countries. The group has been separately linked by CISA/FBI/NSA to a December 2025 attack on Poland's energy grid.

Static Tundra's broader tradecraft, documented by Cisco Talos and corroborated by the FBI (August 2025 advisory) and independent research, shows a mature campaign: attackers exploit Smart Install (TCP 4786) and web administration interfaces on unpatched/EOL Cisco IOS and IOS XE devices, force victim devices to upload startup/running configuration via TFTP, parse the stolen configs for Type 7 passwords, plaintext credentials and SNMP community strings, then use those credentials to pivot deeper into victim networks, create privilege-15 backdoor accounts, modify ACLs/TACACS+ configuration for defense evasion, and in some cases deploy the SYNful Knock firmware implant (first documented in 2015) for stealthy persistent access via crafted 'magic packets.' Given this pattern, CVE-2008-4128's KEV addition should be read as part of the same legacy-router exploitation toolkit rather than an isolated 2026 disclosure — the attackers deliberately target old, forgotten CVEs on devices organizations have failed to patch or decommission.

## MITRE ATT&CK

- T1595 Active Scanning
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1136 Create Account
- T1547 Boot or Logon Autostart Execution
- T1078 Valid Accounts
- T1685 Disable or Modify Tools
- T1601 Modify System Image
- T1552 Unsecured Credentials
- T1098 Account Manipulation
- T1046 Network Service Discovery
- T1040 Network Sniffing
- T1005 Data from Local System
- T1095 Non-Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1020 Automated Exfiltration
- T1498 Network Denial of Service

## Sources

- [CISA Known Exploited Vulnerabilities Catalog (JSON feed)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [CVE-2008-4128 Detail - NVD](https://nvd.nist.gov/vuln/detail/cve-2008-4128)
- [CSA: Improve Router Hygiene (Joint Cybersecurity Advisory)](https://media.defense.gov/2026/Jul/09/2003959498/-1/-1/0/CSA_IMPROVE_ROUTER_HYGIENE.PDF)
- [Officials once again warn defenders that Russian hackers are targeting network devices](https://cyberscoop.com/russian-fsb-cisco-joint-cybersecurity-advisory/)
- [Russian state-sponsored espionage group Static Tundra compromises unpatched end-of-life network devices](https://blog.talosintelligence.com/static-tundra/)
- [Static Tundra Analysis & CVE-2018-0171 Detection Guide](https://www.splunk.com/en_us/blog/security/cve-2018-0171-static-tundra-smart-install-detection-guide.html)
- [FBI: Russia-linked group Static Tundra exploit old Cisco flaw for espionage](https://securityaffairs.com/181347/intelligence/fbi-russia-linked-group-static-tundra-exploit-old-cisco-flaw-for-espionage.html)
- [Russian hackers exploit old Cisco flaw to target global enterprise networks](https://www.csoonline.com/article/4043721/russian-hackers-exploit-old-cisco-flaw-to-target-global-enterprise-networks.html)
- [Russian FSB Center 16 exploits decade-old Cisco flaw in cyber espionage campaign to target critical infrastructure](https://industrialcyber.co/threats-attacks/russian-fsb-center-16-exploits-decade-old-cisco-flaw-in-cyber-espionage-campaign-to-target-critical-infrastructure/)
- [Russian state cyber group Static Tundra exploiting Cisco devices, FBI warns](https://therecord.media/russia-cisco-fsb-static-tundra)
- [FBI Warns FSB-Linked Hackers Exploiting Unpatched Cisco Devices for Cyber Espionage](https://thehackernews.com/2025/08/fbi-warns-russian-fsb-linked-hackers.html)
- [Analytics Story: Cisco Smart Install Remote Code Execution CVE-2018-0171](https://research.splunk.com/stories/cisco_smart_install_remote_code_execution_cve-2018-0171/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1272