CISA Adds CVE-2008-4128 to KEV: An 18-Year-Old Cisco IOS Bug…

CISA's Known Exploited Vulnerabilities catalog now includes CVE-2008-4128, an 18-year-old CSRF flaw in Cisco IOS 12.4. Federal agencies have a three-day remediation window.

On July 13, 2026, CISA added CVE-2008-4128 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation of a Cross-Site Request Forgery vulnerability dating back to 2008 in Cisco IOS 12.4. Federal Civilian Executive Branch agencies were given a three-day remediation window, with a deadline of July 16, 2026. The move underscores how network devices considered stable and relegated to the margins of patch cycles remain exposed to obsolete but effective threats.

Key Takeaways

CISA added CVE-2008-4128 to the KEV catalog on July 13, 2026, with a federal agency remediation deadline of July 16, 2026.
The vulnerability is a CSRF in Cisco IOS 12.4 on the Cisco 871 Integrated Services Router, targeting specific endpoints at privilege level 15.
The National Vulnerability Database assigns a CVSS 3.1 score of 9.3 HIGH, though the CSRF vector with a user-interaction requirement makes the score technically debatable for this category.
CISA has not determined whether the vulnerability is used in ransomware campaigns; the identity of the actors and the scale of exploitation remain unknown.

The Mechanism: CSRF Against the IOS 12.4 HTTP Interface

The official CVE record describes "multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router." The attack exploits two endpoints of the web management interface: the first accepts a forged show privilege command to /level/15/exec/-, the second delivers an alias exec command to /level/15/exec/-/configure/http. Both operate at privilege level 15, the highest administrative level in IOS.

The CSRF nature means the attacker needs no credentials of their own. It is enough to lure an authenticated administrator to visit a malicious web page or execute a compromised resource: the browser automatically sends the authenticated request to the Cisco device, which executes it with the privileges of the active session. According to GBHackers, "because these endpoints operate at privilege level 15, successful exploitation may grant attackers full administrative control of an affected network device." The source does not specify whether confirmed exploitation has led to full compromise or was contained to initial stages.

Why a 2008 Vulnerability Resurfaces in 2026

Cisco IOS 12.4 has been End-of-Life for over a decade. Its persistence in production reflects a recurring dynamic in network infrastructure: routing devices, unlike servers or endpoints, are often deemed "stable" and subjected to longer replacement cycles. The KEV addition shatters this assumption. According to CyberPress, the vulnerability is 18 years old at the time of inclusion; the source emphasizes that the elapsed time has not reduced the attack surface but amplified it through the accumulation of never-decommissioned systems.

The HTTP administration interface, often enabled for remote convenience, represents the primary vector. The dossier does not indicate whether Cisco released updates for later IOS versions, nor whether the affected hardware is still covered by extended support programs. What emerges is that the vulnerability requires no sophisticated exploits: CSRF is a known pattern since 2008, with documented and replicable attack techniques.

The CVSS Discrepancy and CISA Criteria

The National Vulnerability Database lists CVE-2008-4128 with a CVSS 3.1 score of 9.3 HIGH, vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. The score is anomalous for a CSRF: the official vector shows no impact on integrity and availability, even though the description suggests arbitrary command execution. This incongruity is not resolved in the dossier and may reflect an initially optimistic assessment or a subsequent recalibration. CISA does not use CVSS as the sole criterion for KEV inclusion: the presence of "active exploitation in the wild" outweighs any theoretical score.

CISA's official advisory of July 13, 2026 states that "this type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise." The formulation, generic relative to technical details, serves to justify accelerated inclusion without revealing specific indicators of compromise.

"Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain 'show privilege' command to the /level/15/exec/- URI, and (2) a certain 'alias exec' command to the /level/15/exec/-/configure/http URI." — CVE-2008-4128 Record

Immediate Actions

For organizations with legacy Cisco devices, urgency depends on the presence of the HTTP management interface and its network exposure. Priority actions emerge from documented facts:

Verify the presence of Cisco IOS 12.4 or related versions in network assets, with particular attention to 871 Integrated Services Router models.
Disable the HTTP administration interface where not essential, eliminating the primary attack vector documented in the CVE record.
Restrict access to management interfaces to trusted and monitored network segments, reducing the likelihood that a CSRF request reaches the device from unauthorized origins.
Plan replacement of End-of-Life hardware, considering that Cisco IOS 12.4 has not received security fixes for years.

The Technical Debt That Never Retires

The CVE-2008-4128 episode is not an isolated anomaly. Source 7 in the dossier covers a parallel case, CVE-2007-4816, also a legacy Cisco IOS vulnerability subject to recent exploitation: the convergence of patterns suggests the problem is systemic, not incidental. Network infrastructures, by their nature as "always-on" systems rarely touched, accumulate a security debt that traditional patch policies fail to capture.

The three-day window granted to federal agencies — July 13 to 16, 2026 — is the tightest possible within CISA procedural constraints. It does not signal an imminent, catastrophic threat, but the need to treat with extreme urgency what other contexts would manage as technical debt. The absence of information on actors, victims, and associated campaigns prevents quantification of current risk; it does not alter the fact that an 18-year-old bug has cleared the operational relevance threshold for a U.S. government agency.

Frequently Asked Questions

Why does CISA add such dated vulnerabilities to the KEV catalog?

The KEV criterion does not depend on vulnerability age, but on confirmed active exploitation. CVE-2008-4128 meets this requirement in 2026, likely following detections on federal infrastructure or intelligence reports.

Is my Cisco router at risk if I don't use IOS 12.4?

The CVE record specifies IOS 12.4 on the 871 model. If your device runs a different version or is a different model, the documented condition does not automatically apply. The dossier does not list other affected CPEs.

Is the CVSS 9.3 reliable for a CSRF?

The 9.3 HIGH value is the one officially recorded by NVD. The CVSS:3.1 vector structure shows limited impacts on integrity and availability, making the score technically debatable for this vulnerability class. CISA does not use CVSS as a KEV inclusion criterion.

Information verified against cited sources and current as of publication.

Sources

Sources and references