CVE-2008-4128: Cisco IOS Cross-Site Request Forgery Vulnerability
Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI.
Other sources
Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI. NOTE: some of these details are obtained from third party information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-4128?
CVE-2008-4128 is classified as a high-severity vulnerability due to its potential for allowing arbitrary command execution.
How do I fix CVE-2008-4128?
To mitigate CVE-2008-4128, it is recommended to upgrade Cisco IOS to a version later than 12.4 that addresses these CSRF vulnerabilities.
What types of attacks does CVE-2008-4128 enable?
CVE-2008-4128 enables attackers to perform cross-site request forgery attacks, potentially allowing remote command execution on the affected devices.
Which systems are affected by CVE-2008-4128?
CVE-2008-4128 specifically affects Cisco IOS version 12.4 running on the 871 Integrated Services Router.
Is CVE-2008-4128 easy to exploit?
Exploitation of CVE-2008-4128 can be achieved remotely, making it relatively easy for attackers with knowledge of CSRF techniques.