HIGH KEV
Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI
Published Sep 18, 2008 ·Due Jul 16, 2026
8.1
HIGHCVSS 3.1
EPSS 33.87%
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI. NOTE: some of these details are obtained from third party information.
Affected products
No data.
AND
Running on/with
- n/a
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
8.1 HIGH CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact None
No CVSS v3.0 score for this CVE.
9.3 HIGH NVD
AV:N/AC:M/Au:N/C:C/I:C/A:C
Access Vector Network
Access Complexity Medium
Authentication None
Confidentiality Impact Complete
Integrity Impact Complete
Availability Impact Complete
Listed in CISA KEV KEV
Date Added
Jul 13, 2026
Patch Due
Jul 16, 2026
Required Action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
ActiveAutomatable
NoTechnical Impact
TotalDecision
n/aAssessed Sep 23, 2026 · SSVC 2.0.3
33.87% 0.33871
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.
EPSS probability 0.33871
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (14 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 2, 2026 | 33.87% (0.33871) | 98.35th | v5 (v2026.06.15) |
| Jul 24, 2026 | 32.95% (0.32953) | 98.18th | v5 (v2026.06.15) |
| Jul 14, 2026 | 23.86% (0.23857) | 97.56th | v5 (v2026.06.15) |
| Jun 15, 2026 | 12.04% (0.12036) | 95.59th | v5 (v2026.06.15) |
| Jun 28, 2025 | 1.52% (0.01525) | 80.42th | v4 (v2025.03.14) |
| Mar 17, 2025 | 0.48% (0.00482) | 63.13th | v4 (v2025.03.14) |
| Dec 12, 2024 | 1.00% (0.00999) | 84.28th | v3 (v2023.03.01) |
| Mar 29, 2024 | 1.00% (0.00999) | 83.27th | v3 (v2023.03.01) |
| Apr 29, 2023 | 1.10% (0.01097) | 82.30th | v3 (v2023.03.01) |
| Mar 19, 2023 | 0.90% (0.00903) | 80.31th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.76% (0.00755) | 78.15th | v3 (v2023.03.01) |
| Mar 6, 2023 | 4.48% (0.04482) | 88.77th | v2 (v2022.01.01) |
| Apr 1, 2022 | 4.48% (0.04482) | 87.66th | v2 (v2022.01.01) |
| Feb 4, 2022 | 4.48% (0.04482) | 71.45th | v2 (v2022.01.01) |
Weaknesses (1)
References (8)
- http://jbrownsec.blogspot.com/2008/09/cisco-0day-released.html x_refsource_MISCBroken Link
- http://www.securityfocus.com/bid/31218 vdb-entryx_refsource_BIDBroken LinkExploitThird Party AdvisoryVDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45226 vdb-entryx_refsource_XFThird Party AdvisoryVDB Entry
- https://media.defense.gov/2026/Jul/09/2003959498/-1/-1/1/CSA_IMPROVE_ROUTER_HYGIENE.PDF third-party-advisoryThird Party AdvisoryUS Government Resource
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-4128 government-resourceUS Government Resource
- https://www.cisco.com/c/en/us/obsolete/ios-nx-os-software/cisco-ios-software-releases-12-4-mainline.html mitigationProduct
- https://www.exploit-db.com/exploits/6476 exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/6477 exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry
| Link | Providers | Tags |
|---|---|---|
| http://jbrownsec.blogspot.com/2008/09/cisco-0day-released.html | x_refsource_MISCBroken Link | |
| http://www.securityfocus.com/bid/31218 | vdb-entryx_refsource_BIDBroken LinkExploitThird Party AdvisoryVDB Entry | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/45226 | vdb-entryx_refsource_XFThird Party AdvisoryVDB Entry | |
| https://media.defense.gov/2026/Jul/09/2003959498/-1/-1/1/CSA_IMPROVE_ROUTER_HYGIENE.PDF | third-party-advisoryThird Party AdvisoryUS Government Resource | |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-4128 | government-resourceUS Government Resource | |
| https://www.cisco.com/c/en/us/obsolete/ios-nx-os-software/cisco-ios-software-releases-12-4-mainline.html | mitigationProduct | |
| https://www.exploit-db.com/exploits/6476 | exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry | |
| https://www.exploit-db.com/exploits/6477 | exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry |
Change history (47)
- CISA ADP
- SSVC technical impact changed from partial to
total partial → total
- CVSS severity changed from MEDIUM to
HIGH MEDIUM → HIGH
- CVSS vector changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N to
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N → CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- CVSS score changed from 4.3 to
8.1 4.3 → 8.1
- SSVC technical impact changed from partial to
total
- CISA ADP
- SSVC technical impact changed from total to
partial total → partial
- CVSS severity changed from HIGH to
MEDIUM HIGH → MEDIUM
- CVSS vector changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N to
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N → CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- CVSS score changed from 8.1 to
4.3 8.1 → 4.3
- SSVC technical impact changed from total to
partial
- CISA ADP
- SSVC technical impact changed from partial to
total partial → total
- CVSS severity changed from MEDIUM to
HIGH MEDIUM → HIGH
- CVSS vector changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N to
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N → CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- CVSS score changed from 4.3 to
8.1 4.3 → 8.1
- SSVC technical impact changed from partial to
total
- CISA ADP
- SSVC technical impact changed from total to
partial total → partial
- CVSS severity changed from HIGH to
MEDIUM HIGH → MEDIUM
- CVSS vector changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N to
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N → CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- CVSS score changed from 8.1 to
4.3 8.1 → 4.3
- SSVC technical impact changed from total to
partial
- CISA ADP
- SSVC technical impact changed from partial to
total partial → total
- CVSS severity changed from MEDIUM to
HIGH MEDIUM → HIGH
- CVSS vector changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N to
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N → CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- CVSS score changed from 4.3 to
8.1 4.3 → 8.1
- SSVC technical impact changed from partial to
total
- CISA ADP
- SSVC technical impact changed from total to
partial total → partial
- CVSS severity changed from HIGH to
MEDIUM HIGH → MEDIUM
- CVSS vector changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N to
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N → CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- CVSS score changed from 8.1 to
4.3 8.1 → 4.3
- SSVC technical impact changed from total to
partial
- CISA ADP
- SSVC technical impact changed from partial to
total partial → total
- CVSS severity changed from MEDIUM to
HIGH MEDIUM → HIGH
- CVSS vector changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N to
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N → CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- CVSS score changed from 4.3 to
8.1 4.3 → 8.1
- SSVC technical impact changed from partial to
total
- CISA ADP
- SSVC technical impact changed from total to
partial total → partial
- CVSS severity changed from HIGH to
MEDIUM HIGH → MEDIUM
- CVSS vector changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N to
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N → CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- CVSS score changed from 8.1 to
4.3 8.1 → 4.3
- SSVC technical impact changed from total to
partial
- CISA ADP
- SSVC technical impact changed from partial to
total partial → total
- CVSS severity changed from MEDIUM to
HIGH MEDIUM → HIGH
- CVSS vector changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N to
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N → CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- CVSS score changed from 4.3 to
8.1 4.3 → 8.1
- SSVC technical impact changed from partial to
total
- CISA ADP
- SSVC technical impact changed from total to
partial total → partial
- CVSS severity changed from HIGH to
MEDIUM HIGH → MEDIUM
- CVSS vector changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N to
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N → CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- CVSS score changed from 8.1 to
4.3 8.1 → 4.3
- SSVC technical impact changed from total to
partial
- CISA ADP
- SSVC technical impact changed from partial to
total partial → total
- CVSS severity changed from MEDIUM to
HIGH MEDIUM → HIGH
- CVSS vector changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N to
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N → CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- CVSS score changed from 4.3 to
8.1 4.3 → 8.1
- SSVC technical impact changed from partial to
total
- NVD
- CVSS severity changed from MEDIUM to
HIGH MEDIUM → HIGH
- CVSS vector changed from CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N to
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N → CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- CVSS score changed from 4.3 to
8.1 4.3 → 8.1
- CVSS severity changed from MEDIUM to
HIGH
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Sep 18, 2008
Updated Sep 24, 2026
Reserved Sep 18, 2008
Link CVE-2008-4128
CISA Vulnrichment
Updated Sep 23, 2026