DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2008-4128: CVE-2008-4128: Multiple Cross-Site Request Forgery Vulnerabilities in Cisco IOS HTTP Administration

#security #cve #cybersecurity

CVE-2008-4128: Multiple Cross-Site Request Forgery Vulnerabilities in Cisco IOS HTTP Administration

Vulnerability ID: CVE-2008-4128
CVSS Score: 9.3
Published: 2008-09-18

Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via crafted HTTP requests. This occurs because the web administrative server fails to validate request origins or use anti-CSRF tokens, allowing an attacker to abuse an active administrative session.

TL;DR

Unauthenticated remote command execution on Cisco IOS devices via CSRF targeting administrative HTTP endpoints.

⚠️ Exploit Status: ACTIVE

Technical Details

  • CWE ID: CWE-352
  • Attack Vector: Network
  • CVSS Score: 9.3 (v2) / 4.3 (v3.1)
  • EPSS Score: 0.23857 (Percentile: 97.58%)
  • Impact: Arbitrary Command Execution (Privilege Level 15)
  • Exploit Status: Active Exploitation
  • KEV Status: Listed

Affected Systems

  • Cisco IOS 12.4 Mainline
  • Cisco 871 Integrated Services Router (ISR)
  • IOS: 12.4 (Fixed in: None (End of Life))

Exploit Details

  • ExploitDB: Cisco Router HTTP Administration CSRF Remote Command Execution Universal Exploit #1
  • ExploitDB: Cisco Router HTTP Administration CSRF Remote Command Execution Universal Exploit #2

Mitigation Strategies

  • Disable the HTTP and HTTPS administrative web servers.
  • Implement strict IP-based access control lists (ACLs) using the ip http access-class directive.
  • Transition all management tasks to secure protocols such as SSHv2.

Remediation Steps:

  1. Enter global configuration mode using 'configure terminal'.
  2. Execute 'no ip http server' and 'no ip http secure-server' to disable the web administration component.
  3. Define a management ACL containing only designated administration hosts.
  4. Apply the ACL using 'ip http access-class '.
  5. Save the configuration using 'write memory'.

References

Read the full report for CVE-2008-4128 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)