{"id":"cisco-ios-csrf-attacks-jul-2026","category":"patch","status":"live","title":"Cisco IOS web administration flaw CVE-2008-4128 used in attacks; no confirmed fixed release","tldr":"Attackers are using an old Cisco IOS 12.4 web administration flaw to run router commands. The software is unsupported and no fixed release is confirmed. Ask your network provider to identify and replace affected equipment.","summary":"CVE-2008-4128 concerns web administration in Cisco IOS 12.4, originally reported on the Cisco 871 Integrated Services Router. A malicious page can trick a signed-in administrator's browser into sending commands to the router. On 13 July 2026, CISA confirmed exploitation by Russian FSB Center 16 actors and added the flaw to its exploited-vulnerability catalogue. Cisco's linked statement says IOS 12.4 Mainline has been unsupported since 31 January 2016; it does not identify affected builds or a fix for this CVE. As at 3 November 2026, no Cisco-confirmed fixed release was found in the sources checked. CISA's September CVE enrichment rates the flaw High, with a score of 8.1. The reviewed sources do not establish when exploitation began or whether attacks have stopped.","action":"Ask whoever manages your office or family network to check for Cisco equipment running IOS 12.4 and arrange replacement of unsupported equipment. Have them restrict access to web administration while they resolve it; no exact Cisco-confirmed update for this CVE was found.","product":"Cisco IOS 12.4 router software","audience":"work","severity":"high","patch":"none","exploited":true,"cves":["CVE-2008-4128"],"tags":["cisco","ios","router","csrf","actively-exploited","end-of-life"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Cisco IOS Software Releases 12.4 Mainline — Retirement Notification","url":"https://www.cisco.com/c/en/us/obsolete/ios-nx-os-software/cisco-ios-software-releases-12-4-mainline.html","by":"Cisco","date":""},{"kind":"advisory","title":"CISA, NSA, FBI, DC3, & International Partners Urge Improved Router Hygiene to Protect Against Russian State-Sponsored Targeting","url":"https://content.govdelivery.com/accounts/USDHSCISA/bulletins/4205644","by":"CISA","date":"2026-07-13"},{"kind":"advisory","title":"CVE-2008-4128 record, including CISA enrichment","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/4xxx/CVE-2008-4128.json","by":"CVE Program","date":"2026-09-24"},{"kind":"news","title":"CISA adds Cisco IOS flaw to known exploited vulnerabilities catalog","url":"https://www.scworld.com/brief/cisa-adds-cisco-ios-flaw-to-known-exploited-vulnerabilities-catalog","by":"SC Media","date":"2026-07-13"},{"kind":"news","title":"US and security allies warn Russian attacks on critical infrastructure are ramping up against poorly configured and vulnerable networking devices worldwide","url":"https://www.techradar.com/pro/security/us-and-security-allies-warn-russian-attacks-on-critical-infrastructure-are-ramping-up-against-poorly-configured-and-vulnerable-networking-devices-worldwide","by":"TechRadar","date":"2026-07-14"}],"started":"2026-07-13","closed":null,"created":"2026-11-03T22:22:21.081Z","updated":"2026-11-03T22:22:21.081Z","cve_notes":[{"cve":"CVE-2008-4128","name":"Cross-site request forgery in Cisco IOS web administration","what":"A flaw in Cisco IOS 12.4 web administration, reported on the Cisco 871 router, lets a malicious page cause a signed-in administrator's browser to submit router commands.","severity":"unknown","cvss":8.1}],"timeline":[{"at":"2026-09-24","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"CISA's CVE enrichment, timestamped 24 September, lists a High severity score of 8.1 and active exploitation. It provides no fixed software version and links to Cisco's retirement notice.","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/4xxx/CVE-2008-4128.json","by":"CISA via the CVE Program","patch":"none"},{"at":"2026-07-13","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2008-4128 to its Known Exploited Vulnerabilities catalogue. It said Russian FSB Center 16 actors had been observed exploiting this flaw in attacks on networking equipment.","url":"https://content.govdelivery.com/accounts/USDHSCISA/bulletins/4205644","by":"CISA","patch":null},{"at":"2016-01-31","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Cisco ended support for IOS 12.4 Mainline. Its retirement notice gives no CVE-specific affected-version list or fixed release.","url":"https://www.cisco.com/c/en/us/obsolete/ios-nx-os-software/cisco-ios-software-releases-12-4-mainline.html","by":"Cisco","patch":null},{"at":"2008-09-17","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"The CVE record dates public disclosure to 17 September 2008. It describes command execution through cross-site request forgery in Cisco IOS 12.4 web administration on the Cisco 871 Integrated Services Router.","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/4xxx/CVE-2008-4128.json","by":"CVE Program","patch":null}],"url":"https://hard.fyi/live/cisco-ios-csrf-attacks-jul-2026/","json":"https://hard.fyi/api/live?id=cisco-ios-csrf-attacks-jul-2026"}