Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2008-4128: Cisco IOS permits remote command execution via web requests

CVE-2008-4128 · published 18 years ago · actively exploited

Summary

Cisco IOS version 12.4 can be tricked into running commands that an attacker sends through specific web URLs. This could let an outsider control the device and change its configuration. Apply the latest Cisco IOS software update to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
cisco	ios	12.4

Original advisory text

Cisco IOS Cross-Site Request Forgery Vulnerability

Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI.

References

http://www.securityfocus.com/bid/31218 Exploit Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/45226 Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/6476 Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/6477 Exploit Third Party Advisory VDB Entry
https://media.defense.gov/2026/Jul/09/2003959498/-1/-1/1/CSA_IMPROVE_ROUTER_HYGI... Third Party Advisory US Government Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-... US Government Resource
https://www.cisco.com/c/en/us/obsolete/ios-nx-os-software/cisco-ios-software-rel... Product
http://jbrownsec.blogspot.com/2008/09/cisco-0day-released.html Broken Link

Fix within

Internet-facing 3 days

and check for signs of compromise

Internal 14 days

Known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.1 High

Exploitation

Known exploited

Listed in the CISA KEV catalogue - exploitation confirmed in the wild.

34% chance of attack within 30 days

Type

CWE-352Cross-Site Request Forgery (CSRF)

Timeline

Published18 Sep 2008

Updated21 Oct 2026

First seen13 Jul 2026

Sources

CVE-2008-4128 · NVD

CVE-2008-4128 · MITRE

CVE-2008-4128 · CISA KEV

Track software like this

Free during beta