Cisco IOS Vulnerability CVE-2008-4128 Under Active Exploitation

• •CVE-2008-4128 is a CSRF vulnerability in Cisco IOS 12.4, actively exploited since July 2026.
• •CISA has linked the attacks to Russian state actors targeting vulnerable network devices.
• •IT managers are advised to secure routers by updating or replacing affected devices.

CISA has warned of ongoing attacks exploiting the CVE-2008-4128 vulnerability in Cisco IOS 12.4, a cross-site request forgery flaw. This vulnerability, which has been known since 2008, allows attackers to execute arbitrary commands on affected routers. The vulnerability was added to CISA's Known Exploited Vulnerabilities Catalog on July 13, 2026. Attackers, potentially linked to Russian state actors, are targeting poorly configured devices globally. The advisory emphasizes the need for IT managers to check for vulnerable devices and apply necessary updates or replacements. CISA has provided a protection guide detailing countermeasures against these attacks. The vulnerability affects Cisco's 871 Integrated Services Router and poses a medium risk (CVSS 4.3). Recent attacks have highlighted the ongoing threat posed by legacy vulnerabilities in critical infrastructure. Security professionals are urged to implement recommended security measures immediately.