SURIQ
On July 13, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. Nothing unusual there, except this one carries a serial number from 2008. CVE-2008-4128 is a set of cross-site request forgery (CSRF) weaknesses in Cisco IOS 12.4, first disclosed in September 2008. It has sat quietly in the record for almost eighteen years. This week it became a live problem again.
In plain terms: a booby-trapped web page, opened by a network administrator who is already logged in to an old Cisco router, can quietly make that router run administrator-level commands. No password guessing, no fresh login. And because the affected hardware is long retired, there is no patch coming.
What CISA's listing actually means
CISA adds a flaw to the KEV catalog only when there is evidence that attackers are using it in the real world. So the story is not that a decade-old bug still exists on paper. It is that someone is actively hunting for the devices it affects and exploiting them right now. Federal civilian agencies were given a near-term remediation deadline of July 16, 2026; every other organization should read the listing as a prompt to check its own edge.
How the attack works
The weak point is the router's built-in HTTP administration interface, the small web console used to manage the device. Cross-site request forgery means the attacker never needs the administrator's credentials. Instead they trick an administrator who already has an open session into loading a crafted page. That page silently fires requests at privileged URLs on the router, the /level/15/exec/ paths, where level 15 is full administrative privilege. Riding the admin's live session, those requests run commands on the device. The public record describes two specific vectors: a show privilege request and an alias exec request that reaches the device's HTTP configuration path.
Two preconditions are worth stating plainly, because they shape both the risk and the fix. The router's HTTP or HTTPS management server has to be enabled, and an administrator with an active session has to be lured to the attacker's page. Public proof-of-concept exploit code for this flaw has existed since 2008, so the barrier to abuse is low.
Why a medium-severity bug is suddenly urgent
The record carries two very different severity scores under the Common Vulnerability Scoring System (CVSS). The older CVSS 2.0 rates it 9.3 (high); the newer CVSS 3.1 rates it 4.3 (medium). That gap is not a contradiction. The lower modern score reflects the CSRF precondition, that a logged-in administrator has to be tricked. The reason to care is not the number. It is that CISA has evidence of exploitation, and the flaw ranks in the top few percent of all CVEs by exploitation likelihood on the Exploit Prediction Scoring System (EPSS). A moderate score on a device attackers are actively probing beats a high score on something nobody is touching.
Are you affected?
The device at the center of this is the Cisco 871 Integrated Services Router, a small-office router that reached end of life years ago. Cisco's own reference for the affected IOS 12.4 release now points at its obsolete-software archive. You are directly exposed if you still run an 871 on IOS 12.4 with the web management server enabled and reachable.
The broader risk is not limited to one model. Any aging edge device with an exposed web management interface sits in the same class. That is the real signal in this KEV listing: attackers are systematically scanning for management interfaces on out-of-support routers, firewalls, and appliances, precisely because nobody patches what they have forgotten they own.
How to spot it
Start with exposure, then look for abuse:
-
Check whether the HTTP or HTTPS management server is enabled at all, and whether it is reachable from anything other than a trusted management network.
-
In the device's management or access logs, watch for requests to privileged execution paths (the
/level/15/exec/URIs) that you did not initiate, and for configuration changes with no matching change record. -
Map the activity to the MITRE ATT&CK framework: exploitation of a public-facing application (T1190) leading to command execution (T1059) and possible configuration tampering.
What to do this week
There is no software update for this platform, so treat it as configuration and lifecycle work, not patching:
-
Turn off the web admin interface if you do not use it. Managing the device from the command line over SSH removes this entire attack surface.
-
If you must keep web management, restrict it to a trusted management network or jump host with an access list, and never expose it to the internet.
-
Inventory and retire end-of-life edge gear. A device the vendor no longer patches cannot be made safe by patching; plan its replacement.
no ip http server no ip http secure-server
The bigger pattern: forgotten edge gear
The hard part of this story is not the fix. It is knowing the box is still there and still listening. A KEV listing for an eighteen-year-old flaw is a reminder that the most exploitable thing on many networks is the device nobody has logged into for years.
That blind spot is what Suriq watches for on the servers it is deployed on: management interfaces that answer when they should not, configuration that changes without warning, and log signatures that suggest someone is probing. A legacy router like the 871 sits outside that agent footprint, but the discipline is the same. Know every interface that answers on your edge, and shut the ones you do not need.