MSRXCVE-2008-4128
CVE-2008-4128
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVSS 3.1 · CNA
chance of exploitation in the next 30 days (EPSS; higher than 98% of CVEs)
Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI. NOTE: some of these details are obtained from third party information.
Scores
Affected products
- n/a n/a: n/a
5 references (advisories, patches, write-ups)
- https://www.exploit-db.com/exploits/6476 · exploit, x_refsource_EXPLOIT-DB
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45226 · vdb-entry, x_refsource_XF
- http://jbrownsec.blogspot.com/2008/09/cisco-0day-released.html · x_refsource_MISC
- https://www.exploit-db.com/exploits/6477 · exploit, x_refsource_EXPLOIT-DB
- http://www.securityfocus.com/bid/31218 · vdb-entry, x_refsource_BID
Sources: CVE.org, FIRST EPSS. Missing ones did not answer or have no record yet.