CVE-2008-4128

CSRF in Cisco Ios 12.4

CISA KEVActive ExploitationEUVD ExploitedPublic PoCCSRF

Published

18 September 2008

Modified

24 September 2026

KEV Added

13 July 2026

Patch / advisory

View advisory

CVSS Score v3.1 8.1

Click a component to see what it means

Raw vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS Score 0.34 98th percentile

Risk Priority 86 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2008-4128 is a high-severity CSRF (CWE-352) vulnerability in Cisco Ios. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Security Account Manager (T1003.002); ranked in the top 2% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2008-4111

Vulnerability Data

Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and…

(2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI. NOTE: some of these details are obtained from third party information.

CWE(s): CWE-352
KEV Date Added: 13 July 2026

Related Threats

Threat-Actor AttributionAI

Dragonfly (G0035)

Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting | CISA

Salt Typhoon (G1045)

Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting | CISA

AnonOps

Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting | CISA

MITRE ATT&CK Enterprise Techniques

T1003.002 Security Account Manager Credential Access

Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.

attack.mitre.org →

T1003.005 Cached Domain Credentials Credential Access

Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.

attack.mitre.org →

T1003.007 Proc Filesystem Credential Access

Adversaries may gather credentials from the proc filesystem or `/proc`.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

T1012 Query Registry Discovery

Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.

attack.mitre.org →

T1016.002 Wi-Fi Discovery Discovery

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

attack.mitre.org →

Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-20414Same product: Cisco Ios

CVE-2024-20254Same vendor: Cisco

CVE-2024-20255Same vendor: Cisco

CVE-2024-20368Same vendor: Cisco

CVE-2023-20011Same vendor: Cisco

CVE-2023-20113Same vendor: Cisco

CVE-2024-20347Same vendor: Cisco

CVE-2025-20326Same vendor: Cisco

CVE-2024-20252Same vendor: Cisco

CVE-2023-20221Same vendor: Cisco

Affected Assets

cisco

ios

12.4

Mitigating Controls

Control response

Prevent

Stop it (NIST 800-53)

—

Detect

Catch it (NIST detect / respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

V3.3.2
V3.5.1
V10.2.1

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AT-2 Literacy Training and Awareness

addresses: CWE-352

Awareness training educates users on avoiding untrusted links and actions that can be exploited via CSRF.

IA-11 Re-authentication

addresses: CWE-352

Requiring user re-entry of credentials for sensitive actions prevents automated forgery of requests without active user participation.

PM-14 Testing, Training, and Monitoring

addresses: CWE-352

Security testing regimens explicitly include checks for missing or ineffective anti-CSRF protections in web applications.

SI-4 System Monitoring

addresses: CWE-352

Detects anomalous request patterns consistent with cross-site request forgery.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 partial match

blocks

Secure SDLC practices directly require anti-CSRF controls such as tokens or SameSite attributes.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.14 Information transfer partial match

removes

A.5.15 Access control partial match

removes

A.5.16 Identity management partial match

removes

A.5.17 Authentication information partial match

removes

A.5.18 Access rights partial match

removes

A.8.10 Information deletion partial match

removes