Skip to main content
Change Risk Intel
CVE tracker

CVE-2008-4128 — Cisco IOS Cross-Site Request Forgery Vulnerability

Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI.

CVSS
6.8 (Medium)
KEV status
CISA KEV — Listed
First seen (CISA KEV)
Recommended change window
Standard change — retire Cisco IOS 12.4 hardware; there is no supported patch and refresh is the actual remediation.
Vendor advisory
https://www.cisco.com/c/en/us/obsolete/ios-nx-os-software/cisco-ios-software-releases-12-4-mainline.html
Affected products
Cisco IOS

Why this one matters to a CAB

CISA does not add 18-year-old CVEs to KEV for fun. If Cisco IOS 12.4 is on your KEV list in 2026, the finding is not “patch this bug” — it is “an unsupported end-of-life network device is still in production and someone is exploiting it.” Patch is not the answer; refresh is.

Defender’s angle

  • Discovery first: run a CDP/LLDP sweep and correlate against the CMDB. Anything running an IOS 12.4 image is probably a lab hand-me-down or a forgotten branch-office switch.
  • Interim mitigation: disable the HTTP server on any IOS 12.4 device you cannot immediately retire: no ip http server and no ip http secure-server. The CSRF surface goes away with the web UI.
  • Refresh plan: even a like-for-like swap to a current Cisco Catalyst or an equivalent Juniper unit is now cheaper than a breach caused by keeping the old device. Frame the business case in operational-risk terms, not cost-optimization terms.

What to bring to CAB

A retirement plan, not a patch. The change record type is “decommission,” the risk narrative is “unsupported firmware in production,” and the sign-off should include the network team lead.

Sources

This page summarizes publicly available information from CISA KEV, NVD, and the listed vendor advisory. Change Risk Intel does not publish exploit walkthroughs. Verify with your vendor before scheduling any change window.