Intel

CVE-2008-4128

Cisco IOS — Cisco IOS Cross-Site Request Forgery Vulnerability

criticalKEV: actively exploitedPoCEPSS 34%

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI. NOTE: some of these details are obtained from third party information.

Source: CISA_KEVNVDCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

Despite a moderate CVSS v3 score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N), CVE-2008-4128 sits at the 98.3rd EPSS percentile, indicating that exploit code is widely available and actively used — the CVSS score significantly understates operational risk because it does not capture the privilege-escalation impact of arbitrary IOS command execution at level 15. An unauthenticated attacker needs only to lure a logged-in administrator to a malicious page, after which full device control is achievable with no credentials required. Organisations running Cisco 871 ISR devices with the IOS HTTP server enabled — common in legacy KRITIS environments in energy, water, and healthcare sectors — are the primary target profile. The absence of a known ransomware campaign flag does not reduce urgency: the trivial attack path combined with the potential for complete network infrastructure compromise justifies treating this as a critical finding regardless of the nominal CVSS rating.

Runbook · Step 1

Immediate response (0-24 h)

  • Disable the IOS HTTP server immediately on all affected Cisco IOS 12.4 devices unless operationally required: run no ip http server and no ip http secure-server in global configuration mode. This removes the attack surface entirely.
  • Apply the vendor patch: Cisco released fixes for CVE-2008-4128 in later IOS releases — verify the exact target release in the Cisco Security Advisory at cisco.com/security and upgrade affected 871 ISR devices accordingly.
  • Restrict HTTP administrative access to trusted management IP addresses only: configure ip http access-class <ACL-number> with a tight ACL permitting only dedicated management hosts.
  • Terminate all active administrative HTTP sessions and rotate local, TACACS+, and RADIUS credentials for affected devices, since CSRF exploitation occurs in the context of an authenticated administrator session.
  • Move affected devices to an out-of-band management VLAN and block all production/user-VLAN access to TCP 80/443 on router management interfaces until the patch or workaround is fully in place.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Expose the router HTTP management port (TCP 80/443) exclusively via a dedicated out-of-band management network. No direct reachability from production or user VLANs.
  • On-device ACL hardening: Use ip http access-class to whitelist only known management IPs for access to /level/15/exec/- and /level/15/exec/-/configure/http. Drop all other sources.
  • Upstream firewall/IPS rule: Block inbound HTTP requests targeting /level/15/exec/- and /level/15/exec/-/configure/http on router management IPs. Snort pattern: alert tcp any any -> $MGMT_HOSTS 80 (msg:"CVE-2008-4128 CSRF attempt"; content:"/level/15/exec/-"; http_uri; sid:9000001; rev:1;).
  • WAF Referer validation: If a reverse proxy or WAF sits in front of the management interface, reject HTTP requests that carry no Referer header or a Referer from an untrusted origin.
  • Least-privilege admin workstations: Enforce a policy that administrators never browse general web content from the same workstation or browser session used to manage IOS devices — dedicated, hardened admin jump hosts are the correct control.
  • Migrate to SSH-only management: Enable ip ssh version 2 and permanently disable the HTTP server on all IOS devices where web-based management is not strictly required.

Runbook · Step 3

Detection rules

  • IOS HTTP access logs / Syslog: Unexpected GET or POST requests to /level/15/exec/- or /level/15/exec/-/configure/http from IPs outside the management ACL. Watch for %HTTP-3-BADURI or %SYS-5-CONFIG_I syslog messages appearing immediately after HTTP access events.
  • SIEM correlation (Splunk SPL): index=network_devices sourcetype=cisco_ios ("level/15/exec" OR "configure/http") | stats count by src_ip, uri | where count > 2 — flags repeated privileged URI access from unexpected sources.
  • Network telemetry (Zeek/Suricata): HTTP flows where uri contains "/level/15/exec/-" with method GET or POST, originating from hosts outside the defined management subnet, destined for router management IPs.
  • Configuration-change alerting: Syslog event %SYS-5-CONFIG_I: Configured from console by http on vty immediately following an HTTP access event is a strong indicator of successful CSRF exploitation — alert on every occurrence without exception.
  • Sigma rule shape (network proxy logs): detection: keywords: ['/level/15/exec/-', '/level/15/exec/-/configure/http'] condition: keywords scoped to destination IPs matching router management interfaces.

Metrics

Severity
critical
Priority score
206.59
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
4.3
Source: nvd-v3
CVSS v3
4.3
CVSS v4
—
EPSS percentile
98.3 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
33.9 %
Elevated — model estimates 10-50% exploitation likelihood.
Published
2026-07-13 00:00 UTC
CWE
—

Affected operating systems

  • mobile

    cisco / ios12.4

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2008-4128
Cisco IOS — Cisco IOS Cross-Site Request Forgery Vulnerability — CVE-2008-4128 | NEOSEC Intel