DaystoPatch

CiscoExploited incident

Cisco IOS 12.4 HTTP administration cross-site request forgery

CVE-2008-4128High, CVSS 8.1In CISA's Known Exploited Vulnerabilities catalog since 13 Jul 2026

  • Exploited before a fix
  • End of life: vendor advises replacement
End of lifeEnd-of-life product. Cisco advises replacing it and plans no fix, so it is not on the live board.
Embed this live clock

Response

Silence
ongoing
First public report to first vendor statement
Exposure
no fix planned
First public report to first fix
Follow-through
no fix planned
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Exploit-DB EDB-ID 6476 (Jeremy Brown, originally milw0rm)CuratedQuote verified

    # milw0rm.com [2008-09-17]

    Public proof-of-concept titled 'Cisco Router - HTTP Administration Cross-Site Request Forgery / Command Execution (1)', EDB date 2008-09-17. The CVE record gives datePublic 2008-09-17. This is the first public signal that the bug exists; we found no public report of in-the-wild exploitation before the 2026-07-13 KEV listing.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:8b312dcdd62ef459…
    Used in metrics
    Yes
    Dispute this timestamp
    4 more sources for this moment
    CVE.org record CVE-2008-4128ClaimedQuote verified18 Sep 2008, 20:00 UTC

    Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:517786ce6da4667c…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2008-4128)ClaimedQuote verified13 Jul 2026

    Cisco IOS Cross-Site Request Forgery Vulnerability

    Added to CISA's KEV catalog on 2026-07-13.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet13 Jul 2026, 17:29 UTC

    🛑 CVE-2008-4128

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet13 Jul 2026, 17:39 UTC

    Russia's FSB is weaponizing a 2008 Cisco flaw to own end-of-life routers - patch deadline is now. 9 detections, 15 IOCs. Full analysis + IOCs: https:// intel.threadlinqs.com/threat/T L-2026-1272 #

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    No public statement from the vendor found yet.

  3. First workaround

    No official mitigation found yet.

  4. First fix

    No fixed release found yet for any affected branch.

  5. Fixed for all versions

    No evidence yet of fixed releases for every supported branch.

Send this to your boss

Old Cisco IOS 12.4 web-admin flaw now exploited; release is retired, no fix

A 2008 flaw in the web administration of Cisco IOS 12.4 is now being exploited, and the affected software has been retired since 2016 with no fix published.

In plain words

A security weakness in very old Cisco router software, retired by Cisco in 2016, is now being used by attackers. There is no fix for this software version. If we still have routers running it, the safe path is to replace or upgrade them; until then, the routers' web management page should be turned off or locked down.

What happened and who is affected

What happened

CVE-2008-4128 is a cross-site request forgery flaw in the HTTP administration interface of Cisco IOS 12.4: if an administrator who is logged in to the router's web interface visits a malicious page, that page can make the router run commands. A public proof of concept has existed since 17 September 2008. CISA added it to its Known Exploited Vulnerabilities catalog on 13 July 2026, pointing to Cisco's retirement notice for IOS 12.4 Mainline. We found no Cisco security advisory or fixed release for this bug.

Who is affected

Devices running Cisco IOS 12.4 Mainline with the HTTP administration server enabled (the original report used an 871 Integrated Services Router). Cisco retired IOS 12.4 Mainline with an end-of-support date of 2016-01-31.

CVE-2008-4128. Reviewed 22 Oct 2026. https://daystopatch.com/incidents/cisco-cve-2008-4128/

Affected products

  • Cisco IOS 12.4 (HTTP Administration component; reported on the 871 Integrated Services Router)
How we built this timeline

END OF LIFE: Cisco's retirement notice for this release says 'The Cisco IOS Software Releases 12.4 Mainline has been retired and is no longer supported.' with 'End-of-Support Date: 31 Jan 2016', and points customers to 'available Networking Software (IOS & NX-OS) offerings' (https://www.cisco.com/c/en/us/obsolete/ios-nx-os-software/cisco-ios-software-releases-12-4-mainline.html, the only vendor link in the KEV entry). CISA's required action ends with 'discontinue use of the product if mitigations are unavailable'.

No vendor, workaround or patch moments: we found no Cisco security advisory, Cisco response or fixed release for CVE-2008-4128, and the retirement notice does not mention this CVE. Status 'unpatched' reflects that no fix was ever published for the affected release.

Severity/CVSS: the CVE record has no CNA score; NVD shows a CISA-ADP CVSS 3.1 score of 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N; record last modified 24 Sep 2026), used here (high).

NVD's legacy v2 score is 9.3. exploited before a fix=true under R4: no fix has ever existed, and exploitation was reported (KEV 13 Jul 2026). The interim steps in the brief (disable the HTTP server, use SSH) are standard practice, not a Cisco statement about this CVE.

Automated check: exposure over 365 days; needs human review.

Related

No related incidents.

Cisco report card