CISA adds Cisco IOS CSRF flaw to exploited catalog
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Cisco IOS cross-site request forgery vulnerability CVE-2008-4128 added to CISA's Known Exploited Vulnerabilities catalog due to active exploitation.
CISA has added CVE-2008-4128, a cross-site request forgery vulnerability in Cisco IOS, to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation in the wild. CSRF vulnerabilities are a frequent attack vector used by malicious cyber actors and pose significant risks to enterprise environments. This vulnerability is listed as granting total control of affected devices post-exploitation.
Under CISA's Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch agencies are required to prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets. CISA encourages all organizations, regardless of sector or agency status, to adopt risk-based vulnerability management and treat KEV Catalog entries as high-priority remediation targets. Organizations should verify whether systems were compromised before patching and implement appropriate containment measures.
Mentioned in this report
Detection guidance
Cisco IOS HTTP Server Privileged Command URL Requested via Web Proxy
Detects web requests to the Cisco IOS HTTP exec/configure URL paths (/level/15/...), the interface abused in CVE-2008-4128 CSRF attacks to run privileged commands through an admin's browser. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cisco IOS HTTP Server Privileged Command URL Requested via Web Proxy
description: Detects proxied HTTP requests to the Cisco IOS HTTP server privileged
command paths (/level/15/exec/ and /level/15/configure/). CVE-2008-4128 is a CSRF
flaw in this interface, so a victim browser can be made to issue state-changing
GET requests that run device commands. Rare in normal browsing; review the referrer
and source user.
references:
- https://www.cisa.gov/news-events/alerts/2026/07/13/cisa-adds-one-known-exploited-vulnerability-catalog
tags:
- attack.impact
- attack.t1499.004
- attack.lateral-movement
- attack.t1021
logsource:
category: proxy
detection:
selection_path:
c-uri|contains:
- /level/15/exec/
- /level/15/configure/
- /level/14/exec/
selection_method:
cs-method: GET
condition: selection_path and selection_method
falsepositives:
- Network administrators managing Cisco IOS devices through the legacy web interface
via a proxy
- Authorised vulnerability scanners probing IOS HTTP servers
level: medium
id: 7e6b4121-f58b-5f1d-82d4-a4b59198b315
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/alerts/2026/07/13/cisa-adds-one-known-exploited-vulnerability-catalog
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs