CVE-2008-4128: Cisco IOS Cross-Site Request Forgery Vulnerability

This vulnerability is a cross-site request forgery (CWE-352) affecting the HTTP administration component of Cisco IOS 12.4. The embedded web management interface exposes privileged EXEC functionality through URIs such as /level/15/exec/-, which accept state-changing commands via simple GET requests without verifying that the request originated from an intentional, user-initiated action within the management application. Because the browser automatically attaches the authenticated session's credentials (cookie or HTTP Basic auth) to any request it sends, the router cannot distinguish a legitimate administrative click from a request triggered by a malicious page the administrator happens to have open.

If an authenticated administrator's browser is induced to load attacker-controlled content (an image tag, hidden form, or redirect referencing the vulnerable URIs), the router will execute the embedded command with level-15 privilege, as demonstrated by the "show privilege" and "alias exec" cases. The "alias exec" path is particularly severe, since it can be used to define persistent command aliases that later execute arbitrary IOS configuration changes. The CVSS vector confirms the realistic path: network-reachable (AV:N), low attack complexity, no attacker privileges required, but contingent on user interaction — an administrator with an active HTTP management session must visit or be served the malicious content.