Cisco IOS web administration flaw CVE-2008-4128 used in attacks; no confirmed fixed release
Attackers are using an old Cisco IOS 12.4 web administration flaw to run router commands. The software is unsupported and no fixed release is confirmed. Ask your network provider to identify and replace affected equipment.
Ask whoever manages your office or family network to check for Cisco equipment running IOS 12.4 and arrange replacement of unsupported equipment. Have them restrict access to web administration while they resolve it; no exact Cisco-confirmed update for this CVE was found.
What’s happening
CVE-2008-4128 concerns web administration in Cisco IOS 12.4, originally reported on the Cisco 871 Integrated Services Router. A malicious page can trick a signed-in administrator's browser into sending commands to the router. On 13 July 2026, CISA confirmed exploitation by Russian FSB Center 16 actors and added the flaw to its exploited-vulnerability catalogue. Cisco's linked statement says IOS 12.4 Mainline has been unsupported since 31 January 2016; it does not identify affected builds or a fix for this CVE. As at 3 November 2026, no Cisco-confirmed fixed release was found in the sources checked. CISA's September CVE enrichment rates the flaw High, with a score of 8.1. The reviewed sources do not establish when exploitation began or whether attacks have stopped.
- What
- Flaw
- Affects
- Cisco IOS 12.4 router software
- Fixed in
- No fix yet
- Since
- 13 July 2026
Timeline
- UpdateNo fix yet
CISA's CVE enrichment, timestamped 24 September, lists a High severity score of 8.1 and active exploitation. It provides no fixed software version and links to Cisco's retirement notice.
- CISA added
CISA added CVE-2008-4128 to its Known Exploited Vulnerabilities catalogue. It said Russian FSB Center 16 actors had been observed exploiting this flaw in attacks on networking equipment.
- Update
Cisco ended support for IOS 12.4 Mainline. Its retirement notice gives no CVE-specific affected-version list or fixed release.
- Made public
The CVE record dates public disclosure to 17 September 2008. It describes command execution through cross-site request forgery in Cisco IOS 12.4 web administration on the Cisco 871 Integrated Services Router.
Sources
- Cisco IOS Software Releases 12.4 Mainline — Retirement NotificationCisco
- CISA, NSA, FBI, DC3, & International Partners Urge Improved Router Hygiene to Protect Against Russian State-Sponsored TargetingCISA · 13 July 2026
- CVE-2008-4128 record, including CISA enrichmentCVE Program · 24 Sept 2026
- CISA adds Cisco IOS flaw to known exploited vulnerabilities catalogSC Media · 13 July 2026
- US and security allies warn Russian attacks on critical infrastructure are ramping up against poorly configured and vulnerable networking devices worldwideTechRadar · 14 July 2026