CVE-2008-4128

nvd.nist.gov • July 17, 2026

Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI. NOTE: some of these details are obtained from third party information.

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Russian FSB Exploits Vulnerable Routers to Target Critical Infrastructure A joint advisory from 21 global cybersecurity agencies warns that Russian state hackers from the FSB's Center 16 are exploiting poorly configured routers to infiltrate critical infrastructure networks worldwide. The advisory highlights the use of default or weak Simple Network Management Protocol (SNMP) passwords to access sensitive systems in sectors such as defense, energy, healthcare, and finance. Recent attacks have been attributed to the FSB's Center 16, which has been linked to a failed cyberattack on Poland's energy grid in December 2025 that could have left 500,000 citizens without power. The advisory also emphasizes the exploitation of vulnerabilities in Cisco devices, particularly CVE-2018-0171 and CVE-2008-4128. Organizations are urged to enhance their router security by implementing stronger authentication methods and disabling legacy protocols. The UK and EU have imposed sanctions on 24 individuals and entities connected to these cyber operations. This ongoing threat underscores the need for improved cybersecurity hygiene across critical sectors. 76 sources 78

Extracted Entities

CVE-2008-4128

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (2)

Vulnerabilities (1)