Cisco IOS Cross-Site Request Forgery Vulnerability

CVE-2008-4128

July 31, 2026 · CISA · Severity: CRITICAL

Cisco IOS 12.4 contains critical cross-site request forgery (CSRF) vulnerabilities (CVE-2008-4128) that allow remote attackers to execute arbitrary commands. The flaws exist in two specific URIs: "/level/15/exec/-" (via a "show privilege" command) and "/level/15/exec/-/configure/http" (via an "alias exec" command). Cisco has confirmed these vulnerabilities, which affect organizations using the outdated IOS 12.4 software. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged this vulnerability as actively exploited in the wild and added it to its Known Exploited Vulnerabilities catalog as of July 13, 2026. Attackers leveraging these flaws could gain unauthorized control over affected systems, posing significant risks to network security. Organizations using Cisco IOS 12.4 should prioritize patching or mitigation to prevent potential breaches.

Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI. Vendor: Cisco Product: IOS CISA Date Added: 2026-07-13 CVE: CVE-2008-4128 This vulnerability is actively exploited in the wild according to CISA Known Exploited Vulnerabilities catalog.

Key Takeaways

CVE-2008-4128 is actively exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities catalog.
The vulnerability involves privilege escalation or authentication bypass, granting unauthorized access to sensitive functions.
Cisco IOS: Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI.