CVE-2008-4128: Cisco IOS Cross-Site Request Forgery Vulnerability

Overview

CVE-2008-4128 is a set of cross-site request forgery (CSRF) vulnerabilities affecting Cisco IOS 12.4. These flaws allow unauthenticated remote attackers to execute arbitrary commands by tricking an authenticated administrator into visiting a malicious page. The vulnerability has now been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.

Technical Details

The vulnerability exists in the IOS HTTP server interface and can be exploited via two attack vectors:

1. /level/15/exec/- URI — Attackers can forge a request using a crafted show privilege command, causing the device to execute it in the context of an authenticated privileged session.

2. /level/15/exec/-/configure/http URI — A forged alias exec command can be delivered through this path, again leveraging the administrative session without the user's knowledge.

Because the IOS HTTP server trusts authenticated browser sessions without validating request origin, a malicious third-party website can silently issue privileged commands to a Cisco router or switch on the local network.

CISA KEV Addition

CISA's addition of this 2008-era CVE to the KEV catalog in 2026 is significant. It confirms that threat actors are actively targeting legacy Cisco IOS deployments — likely in environments where network equipment has not been replaced or updated in many years.

Federal agencies are required to remediate KEV-listed vulnerabilities within defined timelines under Binding Operational Directive (BOD) 22-01.

Impact

Remediation

Immediate Actions

1. Disable the HTTP server on Cisco IOS devices unless absolutely required:

   no ip http server
   no ip http secure-server
   

   Copy

2. Restrict HTTP management access using access-class lists to limit management interfaces to trusted IP ranges only.

3. Upgrade IOS — Cisco released patches for this vulnerability in 2008. Any device still running IOS 12.4 is severely out of support and should be prioritized for replacement.

4. Audit legacy devices — Inventory all Cisco IOS 12.x devices in your environment and identify those still exposing web management interfaces.

5. Implement network segmentation — Ensure management interfaces are on isolated out-of-band networks, not reachable from user-facing segments.

Detection

Review router logs and netflow data for unexpected HTTP requests to /level/15/exec/ or /level/15/exec/-/configure/ paths. Anomalous configuration changes on network devices may also indicate exploitation.

Background

This vulnerability was originally disclosed in 2008 alongside several related IOS HTTP server flaws. The Cisco IOS HTTP server, when enabled, provides a web-based management interface for routers and switches. At the time of discovery, IOS 12.4 was widely deployed in enterprise and service provider environments.

The fact that this vulnerability is being actively exploited nearly two decades after disclosure underscores the persistent risk posed by legacy network infrastructure that has not been patched or replaced.

References

• NVD: CVE-2008-4128
• CISA Known Exploited Vulnerabilities Catalog
• Cisco Security Advisory (original)