# CVE-2008-4128 — Decades-Old Cisco IOS CSRF Vulnerability Added to CISA KEV After Active Exploitation

> CISA added the 18-year-old CVE-2008-4128 Cross-Site Request Forgery vulnerability in the Cisco IOS HTTP Administration web interface to its Known Exploited Vulnerabilities catalog on 2026-07-13 after confirming active in-the-wild exploitation. The flaw lets a remote attacker execute arbitrary commands on a Cisco 871 Integrated Services Router when an authenticated administrator's browser is tricked into submitting a crafted request.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1301
- **ID:** TL-2026-1301
- **Severity:** HIGH (CVSS 9.3)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2008-4128

## Description

CVE-2008-4128 is a set of cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component of Cisco IOS 12.4 (including 12.4(4) and 12.4(12)) running on the Cisco 871 Integrated Services Router, originally published to NVD on 2008-09-18. The IOS embedded web management server does not enforce anti-CSRF tokens or origin validation on privileged administrative URIs, so a remote attacker can craft a malicious webpage or embedded content that, when loaded in the browser of a network administrator who is currently authenticated to the router's web UI, causes the browser to silently submit privileged HTTP requests on the attacker's behalf using the victim's live session cookie (no credential theft required — the attack rides the existing authenticated session).

Two distinct exploitation vectors are documented, both released as public proof-of-concept by researcher Jeremy Brown on 2008-09-17 (Exploit-DB EDB-ID 6476 and 6477, corroborated by a same-day disclosure post at jbrownsec.blogspot.com titled 'Cisco 0day released'): (1) a 'show privilege' command submitted via POST to the /level/15/exec/- URI, which discloses the current session's privilege level, and (2) an 'alias exec' command submitted via POST to the /level/15/exec/-/configure/http URI, which allows the attacker to define a persistent command alias that can be leveraged to execute arbitrary IOS CLI commands with the victim administrator's privilege level (level 15, the highest). Both PoCs use an auto-submitting HTML form (triggered via the page's onload event) that POSTs the malicious command parameter to the router's admin interface without any visible user interaction; the original PoC documentation explicitly notes that administrators browsing with Safari were considered optimal targets. Because IOS treats the browser-carried session as fully trusted, no additional authentication is required from the attacker — only that the victim's browser hold a live authenticated session and be induced to load attacker content (e.g., via a phishing link or drive-by webpage).

Successful exploitation lets an attacker modify router configuration, create persistent command aliases (a form of on-device backdoor accessible via the IOS CLI), alter routing/firewall settings, run further discovery commands against the network configuration, or disrupt network availability. On 2026-07-13, CISA added CVE-2008-4128 to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild; CISA did not disclose the threat actor, campaign name, exploitation method beyond the two documented URIs, or any indicators of compromise. Federal civilian agencies were given a remediation deadline of 2026-07-16 under Binding Operational Directive requirements (some secondary reporting characterized the deadline as same-day; the KEV catalog date is treated as authoritative). Because Cisco IOS 12.4 and the 871 Integrated Services Router are long past end-of-sale/end-of-life, no vendor patch is available for many deployments; CISA's guidance for such cases is to apply available mitigations, restrict management-plane access, or discontinue use of the affected product.

NVD/CISA-ADP additionally published a CVSS v3.1 rescoring of 4.3 (MEDIUM, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) alongside the original 2008-era CVSS v2.0 score of 9.3 (HIGH, vector AV:N/AC:M/Au:N/C:C/I:C/A:C) — the two scores diverge sharply because CVSS v3.1 more heavily discounts the confidentiality/integrity/availability impact given the required user interaction (UI:R) and unchanged scope (S:U), while the legacy v2.0 methodology treated the full command-execution impact as complete confidentiality/integrity/availability compromise. Both scores are retained here for analyst context; CISA's KEV addition and active-exploitation confirmation is the operative severity driver regardless of the CVSS discrepancy.

## MITRE ATT&CK

- T1588.005 Exploits
- T1189 Drive-by Compromise
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1059 Command and Scripting Interpreter
- T1059.008 Network Device CLI
- T1550.004 Web Session Cookie
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1565.001 Stored Data Manipulation
- T1489 Service Stop
- T1595.002 Vulnerability Scanning
- T1046 Network Service Discovery
- T1005 Data from Local System
- T1098 Account Manipulation

## Sources

- [Decades-Old Cisco IOS Vulnerability Exploited](https://cybersecuritynews.com/decades-old-cisco-ios-vulnerability-exploited/)
- [CISA Known Exploited Vulnerabilities Catalog — CVE-2008-4128](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [CISA Adds One Known Exploited Vulnerability to Catalog](https://www.cisa.gov/news-events/alerts/2026/07/13/cisa-adds-one-known-exploited-vulnerability-catalog)
- [CVE-2008-4128 Detail — NVD](https://nvd.nist.gov/vuln/detail/CVE-2008-4128)
- [CISA adds Cisco IOS flaw to known exploited vulnerabilities catalog](https://www.scworld.com/brief/cisa-adds-cisco-ios-flaw-to-known-exploited-vulnerabilities-catalog)
- [U.S. CISA adds a Cisco IOS flaw to its Known Exploited Vulnerabilities catalog](https://securityaffairs.com/195262/security/u-s-cisa-adds-a-cisco-ios-flaw-to-its-known-exploited-vulnerabilities-catalog.html)
- [CVE-2008-4128 — Vulnerability-Lookup](https://vulnerability.circl.lu/vuln/CVE-2008-4128)
- [CVE-2008-4128 — THREATINT](https://cve.threatint.eu/CVE/CVE-2008-4128)
- [Cisco Router - HTTP Administration CSRF / Command Execution (1) — show privilege](https://www.exploit-db.com/exploits/6476)
- [Cisco Router - HTTP Administration CSRF / Command Execution (2) — alias exec](https://www.exploit-db.com/exploits/6477)
- [IBM X-Force Exchange — CVE-2008-4128 (Vulnerability 45226)](https://exchange.xforce.ibmcloud.com/vulnerabilities/45226)
- [SecurityFocus BID 31218 — Cisco IOS HTTP Admin CSRF](http://www.securityfocus.com/bid/31218)
- [jbrownsec — Cisco 0day released](http://jbrownsec.blogspot.com/2008/09/cisco-0day-released.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1301