This Cisco vulnerability is eighteen years old. CISA just confirmed it is being actively exploited right now.
CVE-2008-4128 — cross-site request forgery flaws in the HTTP administration interface of Cisco IOS 12.4, originally disclosed in 2008. On July 13, CISA added it to the Known Exploited Vulnerabilities catalog with evidence of active exploitation, under a Binding Operational Directive 22-01 remediation deadline of the same day.
WHAT ACTUALLY HAPPENED
The flaw lets an attacker trick an authenticated administrator into unknowingly executing arbitrary commands on the device through the router's web-based admin interface. No new exploitation technique was required. No zero-day research was involved. Attackers simply found devices still running the vulnerable configuration eighteen years after the advisory shipped, and used it.
WHY THIS IS THE MOST DANGEROUS KIND OF FINDING
A fresh CVE gets attention because it is new. An eighteen-year-old CVE getting actively exploited gets far less attention, because most teams assume anything that old was patched, replaced, or decommissioned long ago. That assumption is exactly the gap attackers are working. Legacy network infrastructure with long-lived administrative interfaces does not age out of the threat model just because nobody thinks about it anymore.
This is not a sophisticated attack. It is inventory failure turned into a working exploit.
WHAT TO DO NOW
INVENTORY EVERY DEVICE STILL RUNNING IOS 12.4 OR OLDER — you cannot remediate what you have not identified. Legacy branch routers are the most likely to have been forgotten.
DISABLE THE HTTP ADMINISTRATION INTERFACE WHERE IT IS NOT REQUIRED — CSRF against a web admin panel has no path if the panel is not reachable.
ENFORCE OUT-OF-BAND MANAGEMENT FOR NETWORK DEVICE ADMINISTRATION — administrative sessions should not traverse the same network segment as general traffic, regardless of device age.
TREAT "OLD" AS A RISK CATEGORY, NOT A DISMISSAL — run a recurring audit specifically for devices past end-of-support, not just a one-time inventory.
Eighteen years of dormancy did not make this vulnerability safe. It made it invisible to the teams who should have been tracking it.
Do you have a live inventory of every device on your network still running end-of-life firmware, or is that list from memory?