Detections
Analytics
Cisco IOS 12.4 HTTP Server Cross-Site Request Forgery (CVE-2008-4128)
high Nessus Plugin ID 329207
Language:
Synopsis
The remote device is running a version of Cisco IOS that is affected by a cross-site request forgery vulnerability.Description
According to its self-reported version, Cisco IOS 12.4 is affected by multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP administration component. An unauthenticated, remote attacker can exploit these by persuading an authenticated user to follow a malicious link, allowing execution of arbitrary commands via (1) a 'show privilege' command to the /level/15/exec/- URI or (2) an 'alias exec' command to the /level/15/exec/-/configure/http URI.This version of Cisco IOS reached end-of-life and no vendor fix is available.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
No vendor patch is available as this software has reached end-of-life. Upgrade to a supported version.See Also
https://nvd.nist.gov/vuln/detail/CVE-2008-4128
https://www.exploit-db.com/exploits/6476
Plugin Details
Severity: High
ID: 329207
File Name: cisco_ios_cve-2008-4128.nasl
Version: 1.3
Type: Combined
Family: CISCO
Published: 7/23/2026
Updated: 9/25/2026
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: High
Score: 8.6
Percentile: 99.7
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 7.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2008-4128
CVSS v3
Risk Factor: High
Base Score: 8.1
Temporal Score: 7.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:cisco:ios
Required KB Items: Host/Cisco/IOS/Version
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 9/18/2008
Vulnerability Publication Date: 9/18/2008
CISA Known Exploited Vulnerability Due Dates: 7/16/2026
Reference Information
CVE: CVE-2008-4128