Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI. NOTE: some of these details are obtained from third party information.
Is CVE-2008-4128 exploited?
Listed in the CISA KEV catalog on 2026-07-13.
Federal remediation due 2026-07-16.
Past that date by 30 days.
EPSS puts exploitation in the next 30 days at 33%.
Public exploit code: functional.
Which products and versions are affected?
No affected package list recorded here yet.
Is there a patch?
No patch identifier recorded here yet.
What PlainSec published about CVE-2008-4128
PlainSec has not published a story about this CVE.