Multiple Cross-Site Request Forgery (CSRF) vulnerabilities (CVE-2008-4128) have been identified in the HTTP management component of Cisco 871 Integrated Services Routers running Cisco IOS software provided by Cisco Systems. While this vulnerability is very old and the affected product has already reached End-of-Life (EoL), the U.S. CISA's addition of it to its 'Known Exploited Vulnerabilities (KEV) Catalog' on July 13 reveals that it is currently being actively exploited by Russian state-sponsored attack groups, necessitating immediate action.
Immediate Actions Required
- ✓**Immediate Replacement of Affected Devices:** Since the Cisco 871 Integrated Services Router has already reached End-of-Life (EoL), immediate replacement with a supported, up-to-date device is essential as a fundamental solution.
- ✓**Risk Assessment and Network Isolation if Continued Use is Unavoidable:** If continued use is unavoidable, ensure that the device is not directly exposed to the internet and implement strict network isolation.
- ✓**Check for Signs of Compromise:** Review past logs for any indications of unauthorized access or configuration changes, and consider conducting a forensic investigation. CISA recommends following the relevant 'Forensics Triage Requirements'.
Vulnerability Overview and Scope of Impact
This vulnerability (CVE-2008-4128) stems from multiple CSRF flaws in the HTTP management interface of Cisco 871 Integrated Services Routers running Cisco IOS 12.4. By tricking an authenticated administrator into navigating to a specific URI, a remote attacker could potentially execute arbitrary commands, including privileged and configuration commands. This could lead to a complete compromise of the device.
The NVD's CVSSv2.0 base score is rated 9.3 (HIGH), indicating a severe vulnerability. Although CISA rates the CVSSv3.1 score as 4.3, its urgency is considered very high due to confirmed active exploitation.
Specific Impacts and Attack Scenarios
Attackers lure users with administrative privileges on the target Cisco 871 Integrated Services Router to a crafted website. When the user views that site, the browser automatically sends a malicious request to the router's management interface, executing commands intended by the attacker (e.g., privilege escalation or configuration changes).
According to the U.S. CISA, this vulnerability has been exploited for over a decade by cyber actors affiliated with the Russian Federal Security Service (FSB), targeting organizations in diverse sectors including communications, defense, energy, financial services, government, and healthcare. Attackers leverage vulnerable or misconfigured network devices to steal configuration information or gain full control over devices.
Cisco IOS Software Release 12.4 Mainline reached end-of-support on January 31, 2016, and the Cisco 871 Integrated Services Router reached end-of-support in December 2015. As these are end-of-life products, no official security patches are available.
📦