Cisco IOS 12.4 HTTP Server Cross-Site Request Forgery (CVE-2008-4128)

medium Nessus Plugin ID 329207

Synopsis

The remote device is running a version of Cisco IOS that is affected by a cross-site request forgery vulnerability.

Description

According to its self-reported version, Cisco IOS 12.4 is affected by multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP administration component. An unauthenticated, remote attacker can exploit these by persuading an authenticated user to follow a malicious link, allowing execution of arbitrary commands via (1) a 'show privilege' command to the /level/15/exec/- URI or (2) an 'alias exec' command to the /level/15/exec/-/configure/http URI.

This version of Cisco IOS reached end-of-life and no vendor fix is available.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

No vendor patch is available as this software has reached end-of-life. Upgrade to a supported version.

Plugin Details

Severity: Medium

ID: 329207

File Name: cisco_ios_cve-2008-4128.nasl

Version: 1.1

Type: Combined

Family: CISCO

Published: 7/23/2026

Updated: 7/23/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.7

Percentile: 96.36

CVSS v2

Risk Factor: High

Base Score: 9.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2008-4128

CVSS v3

Risk Factor: Medium

Base Score: 4.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Vulnerability Information

CPE: cpe:/o:cisco:ios

Required KB Items: Host/Cisco/IOS/Version

Patch Publication Date: 9/18/2008

Vulnerability Publication Date: 9/18/2008

CISA Known Exploited Vulnerability Due Dates: 7/16/2026

Reference Information

CVE: CVE-2008-4128

Detections

Analytics