CISA Adds Cisco IOS Vulnerability to Exploited Flaws Catalog
Federal agencies ordered to patch the flaw by July 13, 2026.
1CISA's Critical Move
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a Cisco IOS vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. Tracked as CVE-2008-4128, this flaw particularly affects Cisco 871 Integrated Services Routers running IOS 12.4.
2Technical Details of the Flaw
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities exist in the HTTP Administration interface of Cisco IOS 12.4. Attackers can trick authenticated administrators into executing privileged commands, potentially compromising device security.
3Potential Impacts
This vulnerability allows remote execution of administrative commands. Attackers could modify router configurations, redirect network traffic, or completely take over devices. The flaw could have severe consequences for critical infrastructure operators.
4Federal Mandate
Under Binding Operational Directive 22-01, CISA requires federal agencies to patch this vulnerability by July 13, 2026. Private sector organizations are also advised to review the catalog and implement similar protective measures.
5Cisco's Stance
The company hasn't released a patch yet but recommends disabling the HTTP Administration interface as a temporary workaround. Security experts question why this 15-year-old vulnerability was only now added to the catalog.
6Cybersecurity Warning
Experts emphasize that critical infrastructure operators must address this vulnerability immediately. While CSRF attacks may seem simple, they can completely compromise network security and lead to significant data breaches.
Original article: Security Affairs — CISA, Cisco IOS Güvenlik Açığını Kataloguna Ekledi