CISA Adds 2008 Vulnerability in Cisco IOS to Active Exploitation Catalog

CISA added the vulnerability CVE-2008-4128 to the Known Exploited Vulnerabilities Catalog on Monday (13th), the U.S. federal registry of flaws with evidence of active exploitation. The flaw is a chain of cross-site request forgery (CSRF) in the administrative HTTP interface of Cisco IOS 12.4, present in Cisco 871 Integrated Services Routers, still operational globally 18 years after its initial disclosure.

The attack exploits specific calls via the URI of the administrative interface. An attacker who can make an authenticated administrator access a malicious page can execute commands like show privilege and alias exec on the device without additional authentication, which opens the surface for privilege escalation and remote reconfiguration. According to CISA's advisory, this vector is frequent in opportunistic scans against legacy edge routers, and the observed pattern suggests reuse in current campaigns.

Why a 2008 Flaw Returns in 2026

The Cisco 871 was discontinued over a decade ago. Still, the global installed base survives in branches of small and medium enterprises, in regional last-mile providers, and, most importantly, in operational technology (OT) environments, where replacement depends on industrial maintenance windows. Under the Binding Operational Directive 22-01, U.S. federal civilian agencies have a standard three-week timeframe to remediate after an item enters the KEV. Outside the U.S. government, the registry becomes a contractual trigger for audits, cyber insurance policies, and MSSP contracts worldwide.

This case expands a pattern that has worried CISOs since last year. Older CVEs return to the exploitation cycle because the hardware does not leave service. Cisco has not issued a new patch for CVE-2008-4128, and the official mitigation remains disabling the administrative HTTP interface (no ip http server), migrating administration to HTTPS/SSH, and restricting access via ACL. In environments that rely on the web interface to manage via scripts, this means rewriting automations running for a decade.

Practical Effect in New York, Frankfurt, and São Paulo

In the United States, inclusion in the KEV creates immediate obligations for federal civil executives. Under the new Binding Operational Directive 26-04, published in May, agencies must integrate each entry into their risk scorecards within 48 hours and report remediation to CISA's dashboard. For the federal CISO, the operational line is already clear: sweep the inventory for Cisco 871, check if the HTTP admin is enabled, apply the mitigation, or replace it.

In Germany, the BSI treats U.S. alerts from the KEV as de facto reference since 2023, though without corresponding legal obligation. Regional banks and Sparkassen with agency networks historically purchased Cisco 871 routers in the 2000s, and the KEV update becomes input for the DORA resilience tests, mandatory for the European financial sector since January. OT operators in energy sectors in Spain and Italy fall within the same scope.

In Brazil, CTIR Gov and ANPD treat entries from the KEV as technical references, with little automation over large private enterprises. The real pain point lies with medium-sized MSPs serving retail and credit unions, where the Cisco 871 has survived in points of sale and rural agencies. PCI DSS 4.0 auditors are already requesting explicit evidence of mitigation for any CVE listed in the KEV in quarterly reports.

What the CISO Should Do Now

Three operational steps. First, perform an active sweep for Cisco 871 and IOS 12.4 in the inventory. Second, disable ip http server in any remaining instance and move administration to SSH restricted by ACL. Third, enhance outbound monitoring for known exploit URI calls, feeding the SIEM with specific IOCs.

The underlying warning is not about a CVE from 2008. It is about a pipeline where the paid attack surface is not the new firmware but the kit that no one replaces. While suppliers push new lines to the data center, attackers return to the old corporate perimeter, where the political cost of replacing equipment remains high and the maintenance cycle stays the same.