{"uuid": "101cec91-2dd6-462b-894c-14cd06cb003f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2008-4128", "type": "seen", "source": "https://gist.github.com/alon710/ef8cc0e1c13f907944c45b3a10667b82", "content": "# CVE-2008-4128: CVE-2008-4128: Multiple Cross-Site Request Forgery Vulnerabilities in Cisco IOS HTTP Administration\n\n> **CVSS Score:** 9.3\n> **Published:** 2008-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2008-4128\n\n## Summary\nMultiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via crafted HTTP requests. This occurs because the web administrative server fails to validate request origins or use anti-CSRF tokens, allowing an attacker to abuse an active administrative session.\n\n## TL;DR\nUnauthenticated remote command execution on Cisco IOS devices via CSRF targeting administrative HTTP endpoints.\n\n## Exploit Status: ACTIVE\n\n## Technical Details\n\n- **CWE ID**: CWE-352\n- **Attack Vector**: Network\n- **CVSS Score**: 9.3 (v2) / 4.3 (v3.1)\n- **EPSS Score**: 0.23857 (Percentile: 97.58%)\n- **Impact**: Arbitrary Command Execution (Privilege Level 15)\n- **Exploit Status**: Active Exploitation\n- **KEV Status**: Listed\n\n## Affected Systems\n\n- Cisco IOS 12.4 Mainline\n- Cisco 871 Integrated Services Router (ISR)\n- **IOS**: 12.4 (Fixed in: `None (End of Life)`)\n\n## Mitigation\n\n- Disable the HTTP and HTTPS administrative web servers.\n- Implement strict IP-based access control lists (ACLs) using the ip http access-class directive.\n- Transition all management tasks to secure protocols such as SSHv2.\n\n**Remediation Steps:**\n1. Enter global configuration mode using 'configure terminal'.\n2. Execute 'no ip http server' and 'no ip http secure-server' to disable the web administration component.\n3. Define a management ACL containing only designated administration hosts.\n4. Apply the ACL using 'ip http access-class '.\n5. Save the configuration using 'write memory'.\n\n## References\n\n- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-4128)\n- [Cyber Security Advisory: Improve Router Hygiene](https://media.defense.gov/2026/Jul/09/2003959498/-1/-1/1/CSA_IMPROVE_ROUTER_HYGIENE.PDF)\n- [Exploit Database (6476)](https://www.exploit-db.com/exploits/6476)\n- [Exploit Database (6477)](https://www.exploit-db.com/exploits/6477)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2008-4128) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-21T03:01:22.104691Z"}