{"id":"CVE-2008-4128","kind":"vulnerability","aliases":["CVE-2008-4128"],"related":[],"title":"Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on…","description":"Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain \"show privilege\" command to the /level/15/exec/- URI, and (2) a certain \"alias exec\" command to the /level/15/exec/-/configure/http URI.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Cisco IOS 12.4 has cross-site request forgery flaws in its web admin interface, letting a remote attacker who tricks a logged-in administrator's browser run privileged commands such as changing aliases or showing privilege data. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":9.3,"epss":null,"exploited":true,"exploited_at":"2026-07-13T00:00:00+00:00","products":[{"name":"Cisco IOS","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"cisco ios","fixed":[],"affected":"= 12.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cisco-ios","exploited","infrastructure","network-devices","self-hosted"],"not_affected_if":["http-admin-disabled","non-ios-platform"],"how_to_check":null,"fix":"Apply the mitigation or update in accordance with Cisco's vendor instructions as referenced by CISA; the sources do not name a fixed IOS version.","status":"open","published_at":"2008-09-18T20:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:33:42+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:33:42Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigation or update in accordance with Cisco's vendor instructions as referenced by CISA; the sources do not name a fixed IOS version.\nUnknown whether a workaround is listed in the sources.","summary":"Cisco IOS 12.4 has cross-site request forgery flaws in its web admin interface, letting a remote attacker who tricks a logged-in administrator's browser run privileged commands such as changing aliases or showing privilege data. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["cisco-ios","network-devices","self-hosted"],"confidence":0.6,"analyst_note":"Find the Cisco advisory for CVE-2008-4128 to get affected and fixed IOS versions, and whether the HTTP server must be enabled for exposure; check the CISA KEV entry for the required action deadline.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["http-admin-disabled","non-ios-platform"],"severity_if_unknown":"high"},"cost_usd":0.000406,"input_tokens":2250,"output_tokens":361,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':145C,171C,202C '-2008':19A,22A '-4128':20A,23A '/configure/http':126C '/level/15/exec':114C,125C '1':106C '12.4':17A,41B,89C '2':117C '26':144C,170C,201C 'accord':134C 'action':130C 'activ':82B 'adher':198C 'admin':52B 'administr':12A,64B 'alia':120C 'alias':73B 'allow':98C 'appli':131C 'applic':168C 'arbitrari':103C 'asset':192C 'attack':57B,100C 'base':149C 'bod':143C,169C,200C 'browser':66B 'certain':108C,119C 'chang':72B 'cisa':78B,128C,141C,158C 'cisco':15A,24A,26A,29B,39B,87C 'cisco-io':28B 'cloud':174C 'command':69B,104C,111C,122C 'complianc':139C 'compon':13A 'contain':90C 'cross':3A,44B,93C 'cross-sit':2A,43B,92C 'csrf':7A 'cve':18A,21A 'data':77B 'devic':35B 'discontinu':177C 'ensur':138C,197C 'evalu':190C 'exec':121C 'execut':102C 'exploit':31B,83B 'exposur':195C 'flaw':48B 'follow':167C 'forens':160C 'forgeri':6A,47B,95C 'guidanc':156C,172C 'guidelin':204C 'host':38B 'http':11A 'infrastructur':32B 'instruct':137C 'interfac':53B 'internet':194C 'io':16A,30B,40B,88C 'ios':25A,27A 'let':54B 'list':79B 'log':62B 'logged-in':61B 'mitig':132C,183C 'multipl':1A,91C 'network':34B 'network-devic':33B 'note':155C,166C 'patch':203C 'priorit':146C 'privileg':68B,76B,110C 'product':181C 'remot':56B,99C 'request':5A,46B 'requir':129C,162C 'respons':188C 'risk':151C 'run':67B 'secur':147C 'see':152C,163C 'self':37B 'self-host':36B 'servic':175C 'show':75B,109C 'site':4A,45B,94C 'stakehold':186C 'triag':161C 'trick':59B 'unavail':185C 'updat':148C 'uri':115C,127C 'url':153C,164C 'use':178C 'vendor':136C 'via':105C 'vulner':8A,96C 'web':51B 'wild':86B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2008-09-18T20:00:00+00:00","kev":{"dateAdded":"2026-07-13","dueDate":"2026-07-16","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2008-4128","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2008-4128","severity":null,"published_at":"2026-07-13T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:37+00:00","note":null},{"source":"nvd","external_id":"CVE-2008-4128","url":"https://nvd.nist.gov/vuln/detail/CVE-2008-4128","severity":null,"published_at":"2008-09-18T20:00:00+00:00","modified_at":"2026-09-24T12:52:19+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}