CVE-2008-4128: Cisco IOS | defend.network

What is CVE-2008-4128?

Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI. NOTE: some of these details are obtained from third party information.

CVSS8.1 NVD 3.1

SeverityHIGH

Exploitation In the wild In CISA KEV

EPSS34% · P98

Triage statusActive Exploit

ActionPatch immediately

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWECWE-352

NVD published2008-09-18

NVD last modified2026-09-24

Timeline

2008-09-18Published to the U.S. National Vulnerability Database (NVD)
2026-07-13Added to the CISA Known Exploited Vulnerabilities (KEV) catalog
2026-07-16CISA federal remediation deadline (BOD 22-01)
2026-09-24NVD record last updated

CISA Known Exploited Vulnerability

Cisco IOS Cross-Site Request Forgery Vulnerability

Added to KEV2026-07-13

Federal patch deadline2026-07-16

Known ransomware useUnknown

Affected product

Cisco IOS

NVD also lists CPE entries for: Cisco Ios, Cisco 871 Integrated Services Router

Remediation Steps

Check CISA Known Exploited Vulnerabilities Catalog for Cisco advisory and patch information
Apply vendor patch from Cisco Security Advisories
Verify Cisco IOS version after patching
Monitor for signs of unauthorized access or configuration changes on affected devices

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 2 of August 2026 (August 10 – 16)
Vulnerability Priority Report – Week 1 of August 2026 (August 3 – 9)
Vulnerability Priority Report – Week 4 of July 2026 (July 27 – August 2)
Vulnerability Priority Report – Week 3 of July 2026 (July 20 – 26)
Vulnerability Priority Report – Week 2 of July 2026 (July 13 – 19)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.