The HTTP Administration component in Cisco IOS 12.4 on the Cisco 871 Integrated Services Router has multiple CSRF flaws tracked as CVE-2008-4128. If an attacker leads a signed-in administrator to a crafted page or request, privileged IOS commands can run through that administrator's session. This is not a direct unauthenticated compromise of the router.
Immediate Actions Required
- ✓Determine whether HTTP administration is enabled and which networks can reach it
- ✓Disable HTTP administration when unnecessary, or restrict it to a management network and authorized endpoints
- ✓Execute a migration plan from Cisco 871 hardware to a supported platform
- ✓Review configuration changes and management logs and restore a known-good configuration if unauthorized changes are found
Vulnerability Overview and Scope of Impact
The CVE record identifies Cisco IOS 12.4 on the Cisco 871 Integrated Services Router. Exploitation is CSRF that abuses the administrator's browser and existing session, so victim interaction is required. Restricting access on obsolete equipment reduces exposure temporarily but does not replace migration to supported software and hardware.
NVD publishes CVSS v2.0 9.3 HIGH and CVSS v3.1 4.3 MEDIUM assessments. CVSS v2 has no CRITICAL band, so 9.3 is HIGH rather than CRITICAL. This article displays the newer v3.1 assessment and also discloses the v2 result. The CVE record itself does not attribute exploitation to a state-sponsored actor.
Specific Impacts and Attack Scenarios
Attackers lure users with administrative privileges on the target Cisco 871 Integrated Services Router to a crafted website. When the user views that site, the browser automatically sends a malicious request to the router's management interface, executing commands intended by the attacker (e.g., privilege escalation or configuration changes).
According to the U.S. CISA, this vulnerability has been exploited for over a decade by cyber actors affiliated with the Russian Federal Security Service (FSB), targeting organizations in diverse sectors including communications, defense, energy, financial services, government, and healthcare. Attackers leverage vulnerable or misconfigured network devices to steal configuration information or gain full control over devices.
Cisco IOS Software Release 12.4 Mainline reached end-of-support on January 31, 2016, and the Cisco 871 Integrated Services Router reached end-of-support in December 2015. As these are end-of-life products, no official security patches are available.
📦