CVE-2008-4128: Cisco IOS Cross-Site Request Forgery Vulnerability

High severity · published Sep 18, 2008

CVE-2008-4128

Cisco IOS Cross-Site Request Forgery Vulnerability

In wildKEV

8.1

CVSS

33.9%

EPSS

Yes

On KEV

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI. NOTE: some of these details are obtained from third party information.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)33.9% · higher than 98% of CVEs

Exploited in the wildYes

CISA KEVListed Jul 13, 2026

Federal remediation dueJul 16, 2026

Ransomware campaign useNot known

Affected products

Which versions

Ios · Cisco

12.4 · source: NVD, KEV

In the news

VulnerabilityHigh

[CISA KEV] CVE-2008-4128: Cisco IOS - Cisco IOS Cross-Site Request Forgery Vulnerability

Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI.

IOIOSCVE-2008-4128

Jul 13, 2026·CISA KEV

Affected product

Ios

Cisco

All Ios CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2008-4128

CVE.org

https://www.cve.org/CVERecord?id=CVE-2008-4128

CISA KEV catalogue