Cisco 871 router web admin open to forged commands

Published July 13, 2026 CVE-2008-4128

Cisco's IOS 12.4 software on the 871 router had a bug in its web admin page. A malicious website could trick a logged-in admin's browser into secretly sending commands to the router.

Severity
MediumCVSS 3.1 · 4.3
Fix
Not confirmedLast checked on Sep 4, 2026
Weakness
CWE-352Cross-Site Request Forgery (CSRF)
Exploit likelihood
34% in 30 daysEPSS, higher than 98% of known flaws
Affects
Cisco IOS 12.4
Exploited
Yes, in the wildListed by CISA
Added to CISA list
Jul 13, 2026
Federal fix deadline
Jul 16, 2026

How it works

The router's web admin page did not check that a command request really came from the admin's own action, so a hidden link or page could make the admin's browser submit commands on its own.

What to do

Check whether your Cisco 871 has the HTTP/HTTPS web admin interface turned and is running IOS 12.4. If admins ever browse other sites while still logged into that page, you are exposed.

Technical details

Affected software: Cisco IOS 12.4

CVE-2008-4128 covers cross-site request forgery flaws in the HTTP Administration component of Cisco IOS 12.4 on the 871 Integrated Services Router. An attacker can craft a request to the /level/15/exec/- URI to run a 'show privilege' command, or to /level/15/exec/-/configure/http to add an 'alias exec' command, both riding on an authenticated admin's session cookie. CVSS base score is 4.3 (CWE-352). CISA lists it in the Known Exploited Vulnerabilities catalog, and EPSS puts exploitation probability around 24 percent.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction Required Requires another user to take an action
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact Low Some data can be read
  • Integrity impact None No data tampering
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Open in FIRST.org calculator

References

View Original Source