CVE-2008-4128

State: Published
Severity: 8.1 High
Published: Sep 18, 2008
Updated: Sep 24, 2026
Reserved: Sep 18, 2008

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI. NOTE: some of these details are obtained from third party information.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N	CISA-ADP

Weaknesses

CWE-352 Cross-Site Request Forgery (CSRF)

Affected Products

Product	Versions
n/an/a	n/aAffected

References

6476exploit
cisco-router-csrf(45226)vdb-entry
http://jbrownsec.blogspot.com/2008/09/cisco-0day-released.html
6477exploit
31218vdb-entry
https://media.defense.gov/2026/Jul/09/2003959498/-1/-1/1/CSA_IMPROVE_ROUTER_HYGIENE.PDFthird-party-advisory
https://www.cisco.com/c/en/us/obsolete/ios-nx-os-software/cisco-ios-software-releases-12-4-mainline.htmlmitigation
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-4128government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.