Cisco IOS CVE-2008-4128: 18-Year-Old CSRF in CISA KEV

What to do

1. Find every device running IOS 12.4: run show version and look for Version 12.4, or query your inventory or NMS.
2. On each one, disable the web interface with no ip http server and no ip http secure-server, then save the config.
3. Plan replacement of IOS 12.4 hardware with supported models, as the joint advisory recommends for end-of-life devices.
4. Apply the rest of the advisory: disable Smart Install, move to SNMPv3 authPriv, and block TFTP, SMI and SNMP at the edge.
5. Rotate local passwords on any IOS 12.4 router whose admins browsed the web UI, and store them as type 8 hashes where supported.

How to check if you are affected or compromised

• Run show running-config | include ip http to see whether the web server is on.
• Review HTTP and AAA logs for requests to /level/15/exec/ URIs and for unexpected alias exec entries or new local users in the config.
• Diff the running config against your last known-good backup.
• Look for SNMP Set-Requests to OID 1.3.6.1.4.1.9.9.96.1.1 (Cisco config copy) and outbound TFTP (UDP 69) from routers, the actors' main technique.

What happened#

On July 13, 2026, CISA added CVE-2008-4128, a cross-site request forgery (CSRF) flaw in the Cisco IOS 12.4 web administration interface, to the Known Exploited Vulnerabilities catalog. Federal agencies had until July 16. The bug was published in September 2008. Per the CVE record, a web page visited by a logged-in router admin can make the router run arbitrary commands. It does this by sending a "show privilege" command to /level/15/exec/- and an "alias exec" command to /level/15/exec/-/configure/http. The record names the 871 Integrated Services Router and links public exploit code.

The reason it surfaced now is a joint advisory released the same day, AA26-194A, "Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting." NSA, CISA, FBI and partners in a dozen other countries co-sealed it. It attributes the activity to Russia's FSB Center 16, tracked by industry as Berserk Bear, Dragonfly, Static Tundra and other names. The advisory text says the actors mainly scan for routers that accept default SNMP community strings and make them copy their configuration to an attacker server over TFTP. It adds that they "occasionally exploit" Cisco CVEs, Smart Install and "web portals to manage network devices". It names CVE-2018-0171 and CVE-2008-4128, with a footnote: "CVE-2008-4128 only affects end-of-life Cisco devices."

The advisory builds on an August 2025 FBI alert, which said the unit had been "collecting configuration files for thousands of networking devices" tied to US critical infrastructure.

Who is affected#

Routers running Cisco IOS 12.4 with the HTTP server turned on. Cisco's retirement notice says 12.4 Mainline "has been retired and is no longer supported", with end of support on January 31, 2016. That page is the only vendor reference CISA lists. We found no Cisco security advisory or fixed release for this CVE. The NVD entry scores it CVSS 2.0 9.3, and CISA's enrichment gives CVSS 3.1 8.1, which requires user interaction. The sectors the advisory says are most at risk are communications, defense industrial base, energy, financial services, government (especially state and local) and healthcare.

Do you really need to act?#

Most organizations do not. If you have no IOS 12.4 devices, this CVE does not touch you. Those who do tend to be the ones the advisory describes: small offices, utilities and local governments with an old 800-series router that nobody has looked at in a decade. For them, it matters. The attack needs an administrator with an active session to the router's web UI to load a malicious page, which is narrow but realistic for a box managed through its browser interface. A nation-state actor is known to use it. No patch is coming.

Keep the bigger picture in mind. CSRF is the "occasional" path. The main technique in the advisory is abuse of SNMP with default community strings, which works on any make or age of router. If you are checking for 12.4 devices, do the SNMP and Smart Install hygiene at the same time.

What to do now#

1. Find IOS 12.4 devices: show version | include Version on each router, or a query in your NMS or CMDB.
2. Turn off the web UI on them now: conf t, no ip http server, no ip http secure-server, end, write memory. Manage them over SSH from a management network instead.
3. Budget replacements. The advisory tells defenders to "upgrade end-of-life devices to supported ones."
4. Apply its other mitigations on every router: disable Smart Install, move to SNMPv3 with authPriv, restrict management protocols with ACLs, and block UDP 69, TCP 4786 and UDP 161/162 at the edge.
5. Rotate local credentials and use type 8 password hashing where the platform supports it.

How to tell if you were hit#

On each 12.4 router, check show running-config | include ip http|alias exec|username for an enabled web server, unexpected alias exec entries or unfamiliar local users. Diff the running config against a trusted backup. In proxy, firewall or AAA logs, look for requests to /level/15/exec/. Also hunt for the actors' main technique: inbound SNMP Set-Requests that target OID 1.3.6.1.4.1.9.9.96.1.1 (Cisco config copy), and outbound TFTP from routers to unknown hosts. If you find any, treat the config as stolen and rotate every secret in it, including VPN keys, SNMP strings and RADIUS or TACACS+ secrets.

Timeline#

• Sep 18, 2008 — CVE-2008-4128 published.
• Jan 31, 2016 — Cisco IOS 12.4 Mainline reaches end of support.
• Aug 20, 2025 — FBI warns that FSB Center 16 is targeting networking devices.
• Jul 13, 2026 — Joint advisory AA26-194A names CVE-2008-4128. CISA adds it to KEV the same day (alert; coverage by Security Affairs and WaterISAC).
• Jul 16, 2026 — CISA's remediation deadline for federal agencies.

Vulnerability records

• CVE-2008-4128 · KEV 2026-07-13 · Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. CVE record — CVE-2008-4128 cve.org
2. NVD — CVE-2008-4128 nvd.nist.gov
3. CISA — Known Exploited Vulnerabilities: CVE-2008-4128 cisa.gov
4. CISA — AA26-194A: Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting cisa.gov
5. NSA, CISA, FBI et al. — Joint CSA PP-26-2829 (PDF) ic3.gov
6. Cisco — Cisco IOS Software Releases 12.4 Mainline Retirement Notification cisco.com
7. CISA — CISA Adds One Known Exploited Vulnerability to Catalog (Jul 13, 2026) cisa.gov
8. FBI — I-082025-PSA: Russian Government Cyber Actors Targeting Networking Devices ic3.gov
9. WaterISAC — CISA and Partners Urge Improved Router Hygiene waterisac.org

Coverage and analysis

1. Security Affairs — U.S. CISA adds a Cisco IOS flaw to its KEV catalog securityaffairs.com