Cross-site request forgery in Cisco IOS - CVE-2008-4128
Published: July 17, 2026
Vulnerability identifier: #VU138317
CSH Severity: Critical
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:A/U:Red
CVE-ID: CVE-2008-4128
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vendor: Cisco Systems, Inc
Affected software:
Cisco IOS
Cisco IOS
Detailed vulnerability description
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin in the HTTP Administration component. A remote attacker can trick the victim to visit a specially crafted web page and execute arbitrary commands via "show privilege" command to the "/level/15/exec/-" URI or "alias exec" command to the "/level/15/exec/-/configure/http" URI.
How to mitigate CVE-2008-4128
Install update from vendor's website.
Sources
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45226
- https://www.exploit-db.com/exploits/6476
- https://www.exploit-db.com/exploits/6477
- https://media.defense.gov/2026/Jul/09/2003959498/-1/-1/1/CSA_IMPROVE_ROUTER_HYGIENE.PDF
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-4128
- https://www.cisco.com/c/en/us/obsolete/ios-nx-os-software/cisco-ios-software-releases-12-4-mainline.html