{"vulnerability": "cve-2008-4128", "sightings": [{"uuid": "c2786743-ab44-477a-b7dc-35825a3b7a21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2008-4128", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/6476", "content": "", "creation_timestamp": "2008-09-17T00:00:00.000000Z"}, {"uuid": "330b4d85-1f27-4d9c-af75-f21ab39e6602", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2008-4128", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mqk7rgvkgi27", "content": "\ud83d\uded1 CVE-2008-4128\nCisco IOS\nCVSS 4.3 / EPSS 12% / KEV: No\nTL;DR: Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in\u2026\nhttps://cvesentinel.com/report/CVE-2008-4128?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-07-13T17:29:30.663666Z"}, {"uuid": "ef9c594d-6727-41f7-8127-f35458afb744", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2008-4128", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/6980040", "content": "2026-07-13: [CVE-2008-4128] Cisco IOS Cross-Site Request Forgery VulnerabilityCisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain \"show privilege\" command to the /level/15/exec/- URI, and (2) a certain \"alias exec\" command to the /level/15/exec/-/configure/http URI.\ncisakev", "creation_timestamp": "2026-07-13T17:36:46.662377Z"}, {"uuid": "145eaddb-e04c-47a4-9d92-4d85780919d8", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2008-4128", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/cf568995-99d2-4702-8ea7-b7bc9b680c2a", "content": "", "creation_timestamp": "2026-07-13T18:00:01.842612Z"}, {"uuid": "9fb7965d-2deb-4a22-9762-09439b48e4cc", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2008-4128", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8bd46325-bd51-49ff-a693-75c9d4712903", "content": "", "creation_timestamp": "2026-07-13T18:00:27.531981Z"}, {"uuid": "43f89be6-f553-419a-a8cd-bb61361b6d8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2008-4128", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/116913991762805279", "content": "CISA has added one vulnerability to the KEV catalogue.\n- CVE-2008-4128: Cisco IOS Cross-Site Request Forgery Vulnerability https://www.cve.org/CVERecord?id=CVE-2008-4128\nAnd an advisory:\nImprove Router Hygiene to Protect Against Russian State-Sponsored Targeting https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a #CISA #infosec #vulnerability", "creation_timestamp": "2026-07-13T18:05:39.574541Z"}, {"uuid": "d2ce65dd-6cc7-4350-b9a0-d5400d8d8a31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2008-4128", "type": "seen", "source": "https://bsky.app/profile/secdb.bsky.social/post/3mqketpxyi62r", "content": "\ud83d\udea8 CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0713)\n\n\u26a0\ufe0f CVE-2008-4128 - Cisco IOS Cross-Site Request Forgery Vulnerability\n\n\n#ZEN #SecDB #InfoSec #CISA_KEV", "creation_timestamp": "2026-07-13T19:00:15.979917Z"}, {"uuid": "8deafb42-aa5e-4e58-ad1e-dec6e2cfc26c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2008-4128", "type": "seen", "source": "https://bsky.app/profile/happeningnow.news/post/3mqkf7zlzh32k", "content": "CISA Adds One Known Exploited Vulnerability to Catalog\nCISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2008-4128 Cisco IOS Cross-Site Request\u2026\n\n\ud83d\udd17 https://hnow.live/a/a9d91b60", "creation_timestamp": "2026-07-13T19:07:08.747946Z"}, {"uuid": "4d32fa65-d1c7-40ad-b7f5-80f34eb9ff30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2008-4128", "type": "seen", "source": "https://bsky.app/profile/timb.me.uk/post/3mqkkh5hfw5h2", "content": "https://nvd.nist.gov/vuln/detail/CVE-2008-4128 being added to KEV is somewhat interesting as it's CSRF.\n\nSpecifically, I'd love to see what's been reported about the CSRF is being triggered, such as how they're establishing the IP to target, picking the victims, creating the lure?\n\n(For those [\u2026]", "creation_timestamp": "2026-07-13T20:40:37.354745Z"}, {"uuid": "8d6efa4b-28c5-4bff-ab5c-9e1fca906033", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2008-4128", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mqlit67few22", "content": "\ud83d\udd34 EXPLOITED\n\nCISA flagged an 18-year-old Cisco router flaw (CVE-2008-4128) as actively exploited.\n\nA rigged web page makes an admin's old Cisco 871 router run commands, no password needed.\n\nNo patch, it's end-of-life. Disable the web console or retire it.", "creation_timestamp": "2026-07-14T05:44:12.825192Z"}, {"uuid": "8ddd2c6a-a2a9-4972-855a-3e099cc731d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2008-4128", "type": "seen", "source": "https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrkng2ih2z", "content": "\u05e4\u05d2\u05d9\u05e2\u05d5\u05ea CSRF \u05e7\u05e9\u05d5\u05ea: CVE-2008-4128 \u05d5\u05de\u05d4 \u05e9\u05d0\u05ea\u05d4 \u05e6\u05e8\u05d9\u05da \u05dc\u05d3\u05e2\u05ea\n\n\n\nhttps://khesef.xyz/posts/15EED56A-F709-4360-83B1-802F52214CE4", "creation_timestamp": "2026-07-16T08:03:48.440730Z"}, {"uuid": "5ea079f4-3080-4832-b745-7c8f239b2c64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2008-4128", "type": "seen", "source": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mr3egvarih2n", "content": "CISA Adds CVE-2008-4128 to KEV: An 18-Year-Old Cisco IOS Bug Resurfaces", "creation_timestamp": "2026-07-20T13:08:21.435828Z"}, {"uuid": "101cec91-2dd6-462b-894c-14cd06cb003f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2008-4128", "type": "seen", "source": "https://gist.github.com/alon710/ef8cc0e1c13f907944c45b3a10667b82", "content": "# CVE-2008-4128: CVE-2008-4128: Multiple Cross-Site Request Forgery Vulnerabilities in Cisco IOS HTTP Administration\n\n> **CVSS Score:** 9.3\n> **Published:** 2008-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2008-4128\n\n## Summary\nMultiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via crafted HTTP requests. This occurs because the web administrative server fails to validate request origins or use anti-CSRF tokens, allowing an attacker to abuse an active administrative session.\n\n## TL;DR\nUnauthenticated remote command execution on Cisco IOS devices via CSRF targeting administrative HTTP endpoints.\n\n## Exploit Status: ACTIVE\n\n## Technical Details\n\n- **CWE ID**: CWE-352\n- **Attack Vector**: Network\n- **CVSS Score**: 9.3 (v2) / 4.3 (v3.1)\n- **EPSS Score**: 0.23857 (Percentile: 97.58%)\n- **Impact**: Arbitrary Command Execution (Privilege Level 15)\n- **Exploit Status**: Active Exploitation\n- **KEV Status**: Listed\n\n## Affected Systems\n\n- Cisco IOS 12.4 Mainline\n- Cisco 871 Integrated Services Router (ISR)\n- **IOS**: 12.4 (Fixed in: `None (End of Life)`)\n\n## Mitigation\n\n- Disable the HTTP and HTTPS administrative web servers.\n- Implement strict IP-based access control lists (ACLs) using the ip http access-class directive.\n- Transition all management tasks to secure protocols such as SSHv2.\n\n**Remediation Steps:**\n1. Enter global configuration mode using 'configure terminal'.\n2. Execute 'no ip http server' and 'no ip http secure-server' to disable the web administration component.\n3. Define a management ACL containing only designated administration hosts.\n4. Apply the ACL using 'ip http access-class '.\n5. Save the configuration using 'write memory'.\n\n## References\n\n- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-4128)\n- [Cyber Security Advisory: Improve Router Hygiene](https://media.defense.gov/2026/Jul/09/2003959498/-1/-1/1/CSA_IMPROVE_ROUTER_HYGIENE.PDF)\n- [Exploit Database (6476)](https://www.exploit-db.com/exploits/6476)\n- [Exploit Database (6477)](https://www.exploit-db.com/exploits/6477)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2008-4128) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-21T03:01:22.104691Z"}]}