CVE-2008-4128 Cisco IOS Cross-Site Request Forgery
Remote attackers can execute arbitrary commands on Cisco IOS routers via CSRF attacks in the HTTP administration interface.
- Exploited in the wild
- Since 13 Jul 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2008-4128?
CVE-2008-4128 is a high-severity vulnerability in Cisco Ios, published on 18 Sep 2008. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI. NOTE: some of these details are obtained from third party information.
Weakness: CWE-352
Which versions are affected by CVE-2008-4128?
It affects 1 product.
Products include Cisco Ios.
How do I fix CVE-2008-4128?
No fix has been published for CVE-2008-4128 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 16 Jul 2026.
Is CVE-2008-4128 being exploited?
Yes. Attackers have exploited CVE-2008-4128 in the wild since at least 13 Jul 2026.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Cisco Ios
- CVE-2017-12240 Cisco IOS and IOS XE Software DHCP Remote Code Execution
- CVE-2017-3881 Cisco IOS and IOS XE Remote Code Execution
- CVE-2018-0167 Cisco IOS, XR, and XE Software Buffer Overflow
- CVE-2017-6736 Cisco IOS and IOS XE Software SNMP Remote Code Execution
- CVE-2017-6737 Cisco IOS and IOS XE Software SNMP Remote Code Execution
Sources
Also known as GHSA-6977-wjv6-r929.