Attackers can execute remote commands on Cisco 871 routers via CSRF flaw

Summary

CISA has added CVE-2008-4128 to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation. The vulnerability resides in the HTTP Administration component of Cisco IOS 12.4, specifically affecting the 871 Integrated Services Router.

The flaw allows a remote attacker to execute arbitrary commands on the device by exploiting an authenticated administrator's web browser session. This occurs through specially crafted requests targeting specific URIs within the router's management interface.

Technical details

The vulnerability is a cross-site request forgery (CSRF) issue within the HTTP Administration component of Cisco IOS 12.4. It targets the 871 Integrated Services Router.

Attackers can achieve command execution through two primary vectors:

1. Sending a "show privilege" command to the /level/15/exec/- URI.
2. Using an "alias exec" command directed at the /level/15/exec/-/configure/http URI.

These attacks rely on the victim being an authenticated administrator and visiting a malicious site while their session is active. The malicious site then submits hidden forms to the router's IP address to execute these commands without the user's knowledge.

Affected products and fixed versions

The following product and version are confirmed as vulnerable:

Proof of Concept

Two distinct proof-of-concept exploits have been documented that demonstrate how an attacker can trigger these commands via a web browser.

The first exploit targets the /level/15/exec/- URI to execute the show privilege command. A working proof-of-concept is published at https://www.exploit-db.com/exploits/6476.

The second exploit targets the /level/15/exec/-/configure/http URI using an alias exec command. A working proof-of-concept is published at https://www.exploit-db.com/exploits/6477.

Why this matters for defenders

This vulnerability allows for total control of the asset post-exploitation if the attacker successfully executes commands with sufficient privileges. Because the attack is triggered via a browser, even an administrator following standard procedures can inadvertently compromise the router by visiting a compromised or malicious webpage.

For federal agencies under Binding Operational Directive (BOD) 26-04, this vulnerability requires prioritized remediation because it is listed in the KEV catalog and affects publicly exposed assets that grant total control upon exploitation.

Defender guidance

Prioritize updating Cisco IOS on all 871 Integrated Services Routers to a version where this flaw is addressed. If immediate patching is not possible, disable the HTTP server component of the router's administration interface to close the attack vector.