Cisco 871 Integrated Services Router Cross-Site Request Forgery Vulnerability

Bugtraq ID:	31218
Class:	Design Error
CVE:	CVE-2008-4128
Remote:	Yes
Local:	No
Published:	Sep 17 2008 12:00AM
Updated:	May 07 2015 05:23PM
Credit:	Jeremy Brown
Vulnerable:	Cisco IOS 12.4 Cisco 871 Integrated Services Router 0
Not Vulnerable:

Cisco 871 Integrated Services Router Cross-Site Request Forgery Vulnerability

The Cisco 871 Integrated Services Router is prone to a cross-site request-forgery vulnerability.

Successful exploits can run arbitrary commands on affected devices. This may lead to further network-based attacks.

The 871 Integrated Services Router under IOS 12.4 is vulnerable; other products and versions may also be affected.

Cisco 871 Integrated Services Router Cross-Site Request Forgery Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim into following a malicious URI.

The following examples are available:

• /data/vulnerabilities/exploits/31218.html
• /data/vulnerabilities/exploits/31218-2.html

Cisco 871 Integrated Services Router Cross-Site Request Forgery Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Cisco 871 Integrated Services Router Cross-Site Request Forgery Vulnerability

References:

• 871 Integrated Services Router Homepage (Cisco)
  
• Cisco 0day Released (Jeremy Brown)
  
• Cisco Homepage (Cisco)