---
title: "Cisco IOS CVE-2008-4128: 18-Year-Old CSRF in CISA KEV"
url: https://erroneo.us/security/briefs/cisco-ios-12-4-csrf-cve-2008-4128-fsb-kev/
description: "Russian FSB Center 16 actors exploited a 2008 CSRF in the Cisco IOS 12.4 web UI. There is no patch; replace old routers or turn off their HTTP server."
type: security-brief
section: "Security Digest"
date_published: 2026-07-13
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2008-4128"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Cisco IOS CVE-2008-4128: 18-Year-Old CSRF in CISA KEV

**Verdict: Check exposure.** Only organizations still running retired IOS 12.4 routers are exposed, but a Russian state unit is using this bug; find those boxes, turn off their web server today and replace them.

- **Who must act:** Anyone with Cisco routers on IOS 12.4, typically old 800-series branch or small-site routers, especially where the HTTP management interface is enabled or reachable.
- **Who can relax:** Networks with no IOS 12.4 devices; this CVE is scoped to IOS 12.4 and Cisco says the release has been retired since 2016.
- **Affected:** Cisco IOS 12.4 with the HTTP administration server enabled (the CVE record names the 871 Integrated Services Router)
- **Fixed:** No fixed release: IOS 12.4 Mainline is retired, with end of support on Jan 31, 2016; Mitigation only: replace the device, or disable the HTTP and HTTPS servers (no ip http server / no ip http secure-server)
- **CVEs:** CVE-2008-4128
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Find every device running IOS 12.4: run show version and look for Version 12.4, or query your inventory or NMS.
2. On each one, disable the web interface with no ip http server and no ip http secure-server, then save the config.
3. Plan replacement of IOS 12.4 hardware with supported models, as the joint advisory recommends for end-of-life devices.
4. Apply the rest of the advisory: disable Smart Install, move to SNMPv3 authPriv, and block TFTP, SMI and SNMP at the edge.
5. Rotate local passwords on any IOS 12.4 router whose admins browsed the web UI, and store them as type 8 hashes where supported.

### How to check if you are affected

- Run show running-config | include ip http to see whether the web server is on.
- Review HTTP and AAA logs for requests to /level/15/exec/ URIs and for unexpected alias exec entries or new local users in the config.
- Diff the running config against your last known-good backup.
- Look for SNMP Set-Requests to OID 1.3.6.1.4.1.9.9.96.1.1 (Cisco config copy) and outbound TFTP (UDP 69) from routers, the actors' main technique.

## What happened

On July 13, 2026, CISA added CVE-2008-4128, a cross-site request forgery (CSRF) flaw in the Cisco IOS 12.4 web administration interface, to the [Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-4128). Federal agencies had until July 16. The bug was published in September 2008. Per the [CVE record](https://www.cve.org/CVERecord?id=CVE-2008-4128), a web page visited by a logged-in router admin can make the router run arbitrary commands. It does this by sending a "show privilege" command to `/level/15/exec/-` and an "alias exec" command to `/level/15/exec/-/configure/http`. The record names the 871 Integrated Services Router and links public exploit code.

The reason it surfaced now is a joint advisory released the same day, [AA26-194A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a), "Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting." NSA, CISA, FBI and partners in a dozen other countries co-sealed it. It attributes the activity to Russia's FSB Center 16, tracked by industry as Berserk Bear, Dragonfly, Static Tundra and other names. The [advisory text](https://www.ic3.gov/CSA/2026/260713.pdf) says the actors mainly scan for routers that accept default SNMP community strings and make them copy their configuration to an attacker server over TFTP. It adds that they "occasionally exploit" Cisco CVEs, Smart Install and "web portals to manage network devices". It names CVE-2018-0171 and CVE-2008-4128, with a footnote: "CVE-2008-4128 only affects end-of-life Cisco devices."

The advisory builds on an [August 2025 FBI alert](https://www.ic3.gov/PSA/2025/PSA250820), which said the unit had been "collecting configuration files for thousands of networking devices" tied to US critical infrastructure.

## Who is affected

Routers running Cisco IOS 12.4 with the HTTP server turned on. Cisco's [retirement notice](https://www.cisco.com/c/en/us/obsolete/ios-nx-os-software/cisco-ios-software-releases-12-4-mainline.html) says 12.4 Mainline "has been retired and is no longer supported", with end of support on January 31, 2016. That page is the only vendor reference CISA lists. We found no Cisco security advisory or fixed release for this CVE. The [NVD](https://nvd.nist.gov/vuln/detail/CVE-2008-4128) entry scores it CVSS 2.0 9.3, and CISA's enrichment gives CVSS 3.1 8.1, which requires user interaction. The sectors the advisory says are most at risk are communications, defense industrial base, energy, financial services, government (especially state and local) and healthcare.

## Do you really need to act?

Most organizations do not. If you have no IOS 12.4 devices, this CVE does not touch you. Those who do tend to be the ones the advisory describes: small offices, utilities and local governments with an old 800-series router that nobody has looked at in a decade. For them, it matters. The attack needs an administrator with an active session to the router's web UI to load a malicious page, which is narrow but realistic for a box managed through its browser interface. A nation-state actor is known to use it. No patch is coming.

Keep the bigger picture in mind. CSRF is the "occasional" path. The main technique in the advisory is abuse of SNMP with default community strings, which works on any make or age of router. If you are checking for 12.4 devices, do the SNMP and Smart Install hygiene at the same time.

## What to do now

1. Find IOS 12.4 devices: `show version | include Version` on each router, or a query in your NMS or CMDB.
2. Turn off the web UI on them now: `conf t`, `no ip http server`, `no ip http secure-server`, `end`, `write memory`. Manage them over SSH from a management network instead.
3. Budget replacements. The advisory tells defenders to "upgrade end-of-life devices to supported ones."
4. Apply its other mitigations on every router: disable Smart Install, move to SNMPv3 with authPriv, restrict management protocols with ACLs, and block UDP 69, TCP 4786 and UDP 161/162 at the edge.
5. Rotate local credentials and use type 8 password hashing where the platform supports it.

## How to tell if you were hit

On each 12.4 router, check `show running-config | include ip http|alias exec|username` for an enabled web server, unexpected `alias exec` entries or unfamiliar local users. Diff the running config against a trusted backup. In proxy, firewall or AAA logs, look for requests to `/level/15/exec/`. Also hunt for the actors' main technique: inbound SNMP Set-Requests that target OID `1.3.6.1.4.1.9.9.96.1.1` (Cisco config copy), and outbound TFTP from routers to unknown hosts. If you find any, treat the config as stolen and rotate every secret in it, including VPN keys, SNMP strings and RADIUS or TACACS+ secrets.

## Timeline

- Sep 18, 2008 — CVE-2008-4128 published.
- Jan 31, 2016 — Cisco IOS 12.4 Mainline reaches end of support.
- Aug 20, 2025 — FBI warns that FSB Center 16 is targeting networking devices.
- Jul 13, 2026 — Joint advisory AA26-194A names CVE-2008-4128. CISA adds it to KEV the same day ([alert](https://www.cisa.gov/news-events/alerts/2026/07/13/cisa-adds-one-known-exploited-vulnerability-catalog); coverage by [Security Affairs](https://securityaffairs.com/195262/hacking/u-s-cisa-adds-a-cisco-ios-flaw-to-its-known-exploited-vulnerabilities-catalog.html) and [WaterISAC](https://www.waterisac.org/tlpclear-cisa-and-partners-urge-improved-router-hygiene-to-counter-russian-state-sponsored-targeting)).
- Jul 16, 2026 — CISA's remediation deadline for federal agencies.

## Sources

1. [CVE record — CVE-2008-4128](https://www.cve.org/CVERecord?id=CVE-2008-4128)
2. [NVD — CVE-2008-4128](https://nvd.nist.gov/vuln/detail/CVE-2008-4128)
3. [CISA — Known Exploited Vulnerabilities: CVE-2008-4128](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-4128)
4. [CISA — AA26-194A: Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a)
5. [NSA, CISA, FBI et al. — Joint CSA PP-26-2829 (PDF)](https://www.ic3.gov/CSA/2026/260713.pdf)
6. [Cisco — Cisco IOS Software Releases 12.4 Mainline Retirement Notification](https://www.cisco.com/c/en/us/obsolete/ios-nx-os-software/cisco-ios-software-releases-12-4-mainline.html)
7. [CISA — CISA Adds One Known Exploited Vulnerability to Catalog (Jul 13, 2026)](https://www.cisa.gov/news-events/alerts/2026/07/13/cisa-adds-one-known-exploited-vulnerability-catalog)
8. [FBI — I-082025-PSA: Russian Government Cyber Actors Targeting Networking Devices](https://www.ic3.gov/PSA/2025/PSA250820)
9. [WaterISAC — CISA and Partners Urge Improved Router Hygiene](https://www.waterisac.org/tlpclear-cisa-and-partners-urge-improved-router-hygiene-to-counter-russian-state-sponsored-targeting)
10. [Security Affairs — U.S. CISA adds a Cisco IOS flaw to its KEV catalog](https://securityaffairs.com/195262/hacking/u-s-cisa-adds-a-cisco-ios-flaw-to-its-known-exploited-vulnerabilities-catalog.html)

---
Source page: https://erroneo.us/security/briefs/cisco-ios-12-4-csrf-cve-2008-4128-fsb-kev/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt