CVE-2008-4128: Cisco IOS CSRF in HTTP Administration component

CVE-2008-4128 · Severity: critical · CVSS 9.3 · Exploited in the wild · Published 2026-07-13

A security vulnerability exists in the web-based management interface of certain Cisco routers. If an administrative user visits a malicious website while logged into the router's management console, an attacker could silently execute commands on the device. This could allow an unauthorized person to take full control of the network hardware, potentially leading to data interception or network outages.

Technologies: Cisco IOS. Vendors: Cisco.

Quick answers

Is CVE-2008-4128 exploited in the wild?
Yes. CVE-2008-4128 is known to be exploited in the wild, first recorded on 13 July 2026. Treat it as urgent.
How severe is CVE-2008-4128?
Critical severity, with a CVSS score of 9.3, published 13 July 2026.
Which products and versions are affected?
Cisco 871 Integrated Services Router 12.4; Cisco IOS 12.4.
Is there a fix for CVE-2008-4128?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2008-4128 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2008-4128?
Check whether you run Cisco 871 Integrated Services Router or Cisco IOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities exist in the HTTP Administration component of Cisco IOS 12.4. The flaw is rooted in the lack of unique, unpredictable tokens for sensitive administrative requests. An attacker can exploit this by tricking an authenticated administrator into clicking a malicious link or visiting a crafted webpage. Specifically, the vulnerability allows command execution via the '/level/15/exec/-' and '/level/15/exec/-/configure/http' URIs using 'show privilege' and 'alias exec' commands. Successful exploitation grants the attacker the ability to execute arbitrary commands with level 15 (administrative) privileges.

Affected products

  • Cisco IOS 12.4
  • Cisco 871 Integrated Services Router 12.4

Timeline

  • 2008-09-18: disclosed: Initial NVD publication
  • 2026-07-13: advisory: CISA-ADP enrichment and update

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.