Cisco IOS 12.4 HTTP Administration Component Cross-Site Request Forgery (CSRF) Remote Command Execution (CVE-2008-4128)

1. Temporary Mitigation (Disable HTTP Services)

If the web-based management interface is not required, disable the HTTP and HTTPS server daemons entirely:

Router# configure terminal
Router(config)# no ip http server
Router(config)# no ip http secure-server
Router(config)# end
Router# write memory

2. Restrict Access via Access Control Lists (ACLs)

If web management is necessary, restrict access to trusted administrator IP addresses only:

Router(config)# access-list 10 permit 192.168.1.0 0.0.0.255
Router(config)# ip http access-class 10

3. Permanent Resolution

Upgrade to a supported and patched Cisco IOS software release that addresses this vulnerability.

This vulnerability is a Cross-Site Request Forgery (CSRF, CWE-352) in the HTTP Administration component of Cisco IOS 12.4 on Cisco 871 routers.

The Cisco IOS web management interface fails to implement sufficient CSRF protections, such as unique anti-CSRF tokens. Consequently, if an authenticated administrator visits a malicious website or clicks a crafted link, the attacker can force the administrator's browser to send unauthorized requests to the router.

Attackers can exploit this vulnerability via two primary vectors:

• Sending a show privilege or other arbitrary commands to the /level/15/exec/- URI.
• Sending an alias exec command to the /level/15/exec/-/configure/http URI to modify configuration settings or establish persistent command aliases.

This vulnerability is listed in the CISA KEV (Known Exploited Vulnerabilities) catalog and has a high EPSS score of 0.94, indicating active historical exploitation in the wild.