CVE-2008-4128 — Decades-Old Cisco IOS CSRF Vulnerability Added to CISA KEV After Active Exploitation

CVE-2008-4128 (TL-2026-1301) is a high-severity software vulnerability scored CVSS 9.3, first published 2026-07-14. It has no confirmed attribution, affects Cisco IOS, references 1 CVE (CVE-2008-4128), maps to 15 MITRE ATT&CK techniques (T1005, T1016, T1046), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-1301

Threat ID
TL-2026-1301
Severity
HIGH
CVSS
9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-14
Last reviewed
2026-07-14
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, telecoms, critical-infrastructure, enterprise-networking
Target regions
Global
Detection rules
9
Indicators of compromise
18

Malware and tooling in CVE-2008-4128

Malware and tooling: Exploit-DB EDB-ID 6476, Exploit-DB EDB-ID 6477

CISA added the 18-year-old CVE-2008-4128 Cross-Site Request Forgery vulnerability in the Cisco IOS HTTP Administration web interface to its Known Exploited Vulnerabilities catalog on 2026-07-13 after confirming active in-the-wild exploitation. The flaw lets a remote attacker execute arbitrary commands on a Cisco 871 Integrated Services Router when an authenticated administrator's browser is tricked into submitting a crafted request.

How CVE-2008-4128 works

CVE-2008-4128 is a set of cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component of Cisco IOS 12.4 (including 12.4(4) and 12.4(12)) running on the Cisco 871 Integrated Services Router, originally published to NVD on 2008-09-18. The IOS embedded web management server does not enforce anti-CSRF tokens or origin validation on privileged administrative URIs, so a remote attacker can craft a malicious webpage or embedded content that, when loaded in the browser of a network administrator who is currently authenticated to the router's web UI, causes the browser to silently submit privileged HTTP requests on the attacker's behalf using the victim's live session cookie (no credential theft required — the attack rides the existing authenticated session).

Two distinct exploitation vectors are documented, both released as public proof-of-concept by researcher Jeremy Brown on 2008-09-17 (Exploit-DB EDB-ID 6476 and 6477, corroborated by a same-day disclosure post at jbrownsec.blogspot.com titled 'Cisco 0day released'): (1) a 'show privilege' command submitted via POST to the /level/15/exec/- URI, which discloses the current session's privilege level, and (2) an 'alias exec' command submitted via POST to the /level/15/exec/-/configure/http URI, which allows the attacker to define a persistent command alias that can be leveraged to execute arbitrary IOS CLI commands with the victim administrator's privilege level (level 15, the highest). Both PoCs use an auto-submitting HTML form (triggered via the page's onload event) that POSTs the malicious command parameter to the router's admin interface without any visible user interaction; the original PoC documentation explicitly notes that administrators browsing with Safari were considered optimal targets. Because IOS treats the browser-carried session as fully trusted, no additional authentication is required from the attacker — only that the victim's browser hold a live authenticated session and be induced to load attacker content (e.g., via a phishing link or drive-by webpage).

Successful exploitation lets an attacker modify router configuration, create persistent command aliases (a form of on-device backdoor accessible via the IOS CLI), alter routing/firewall settings, run further discovery commands against the network configuration, or disrupt network availability. On 2026-07-13, CISA added CVE-2008-4128 to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild; CISA did not disclose the threat actor, campaign name, exploitation method beyond the two documented URIs, or any indicators of compromise. Federal civilian agencies were given a remediation deadline of 2026-07-16 under Binding Operational Directive requirements (some secondary reporting characterized the deadline as same-day; the KEV catalog date is treated as authoritative). Because Cisco IOS 12.4 and the 871 Integrated Services Router are long past end-of-sale/end-of-life, no vendor patch is available for many deployments; CISA's guidance for such cases is to apply available mitigations, restrict management-plane access, or discontinue use of the affected product.

NVD/CISA-ADP additionally published a CVSS v3.1 rescoring of 4.3 (MEDIUM, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) alongside the original 2008-era CVSS v2.0 score of 9.3 (HIGH, vector AV:N/AC:M/Au:N/C:C/I:C/A:C) — the two scores diverge sharply because CVSS v3.1 more heavily discounts the confidentiality/integrity/availability impact given the required user interaction (UI:R) and unchanged scope (S:U), while the legacy v2.0 methodology treated the full command-execution impact as complete confidentiality/integrity/availability compromise. Both scores are retained here for analyst context; CISA's KEV addition and active-exploitation confirmation is the operative severity driver regardless of the CVSS discrepancy.

MITRE ATT&CK techniques used in TL-2026-1301

Collection

T1005 Data from Local System

Discovery

T1016 System Network Configuration Discovery; T1046 Network Service Discovery; T1082 System Information Discovery

Execution

T1059 Command and Scripting Interpreter; T1059.008 Network Device CLI; T1204.001 Malicious Link

Persistence

T1098 Account Manipulation

Initial Access

T1189 Drive-by Compromise; T1566.002 Spearphishing Link

Impact

T1489 Service Stop; T1565.001 Stored Data Manipulation

lateral-movement

T1550.004 Web Session Cookie

Resource Development

T1588.005 Exploits

Reconnaissance

T1595.002 Vulnerability Scanning

Affected products and versions in CVE-2008-4128

  • Cisco — IOS
    Vulnerable versions: 12.4; 12.4(4); 12.4(12)
  • Cisco — 871 Integrated Services Router
    Vulnerable versions: all firmware running affected IOS 12.4 releases

Remediation for CVE-2008-4128

Patches

  • No vendor patch available for Cisco IOS 12.4 / Cisco 871 ISR — product line is end-of-life; per CISA guidance, discontinue use if mitigations cannot be applied

Immediate actions

  • Restrict access to the Cisco IOS HTTP/HTTPS management interface (ip http server / ip http secure-server) to trusted management networks only via ACLs
  • Disable the embedded HTTP administration server entirely if web-based management is not required (no ip http server / no ip http secure-server)
  • Require administrators to log out of authenticated router web sessions before browsing other sites, or use a dedicated browser/session for device management
  • Audit existing IOS device configurations for unexpected 'alias exec' command aliases indicating prior exploitation

Workarounds

  • Disable the IOS HTTP/HTTPS administration server (no ip http server / no ip http secure-server)
  • Restrict management interface access via access-class / management ACLs to a small set of trusted administrator source addresses

Longer-term hardening

  • Migrate affected Cisco 871 Integrated Services Router / IOS 12.4 deployments to a currently supported IOS or IOS XE release with vendor security support
  • Enforce out-of-band management network segmentation so router administration interfaces are never reachable from general-purpose browsing networks
  • Adopt centralized network device configuration management with change-detection alerting to catch unauthorized alias/config changes

CVEs associated with CVE-2008-4128

CVE-2008-4128

Weaknesses (CWE) in CVE-2008-4128

CWE-352

Timeline of CVE-2008-4128

  • Researcher Jeremy Brown discloses the CSRF vulnerabilities via a blog post ('Cisco 0day released' at jbrownsec.blogspot.com) and publishes public proof-of-concept exploit code for both attack vectors to Exploit-DB as entries 6476 (show privilege) and 6477 (alias exec).
  • CVE-2008-4128 originally published to NVD, describing CSRF vulnerabilities in the Cisco IOS 12.4 HTTP Administration interface on the Cisco 871 Integrated Services Router; SecurityFocus (BID 31218) and IBM X-Force Exchange (vulnerability 45226) also index the flaw.
  • Public proof-of-concept exploit code for both CSRF attack vectors becomes broadly indexed and mirrored across vulnerability-tracking sources following the initial Exploit-DB publication.
  • NVD/CISA-ADP publishes a supplemental CVSS v3.1 rescoring of 4.3 (MEDIUM) alongside the original 2008 CVSS v2.0 score of 9.3 (HIGH), reflecting the differing treatment of required user interaction between the two scoring methodologies.
  • CISA publishes 'CISA Adds One Known Exploited Vulnerability to Catalog' alert covering CVE-2008-4128.
  • CISA adds CVE-2008-4128 to the Known Exploited Vulnerabilities (KEV) catalog after confirming active in-the-wild exploitation, 18 years after original disclosure.
  • Cyber Security News, SC Media, and Security Affairs publish coverage of the KEV addition and the risk posed by unpatched legacy Cisco IOS devices.
  • Deadline for U.S. federal civilian executive branch agencies to remediate CVE-2008-4128 per CISA Binding Operational Directive requirements (per the KEV catalog entry; some secondary reporting characterized the deadline as same-day with the KEV addition).

Sources cited for CVE-2008-4128

Threats related to CVE-2008-4128

Detection coverage for TL-2026-1301

As of 2026-07-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1301 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats