Cisco IOS Cross-Site Request Forgery Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 13/07/2026. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| IOS | Versions not published yet (product named by CISA KEV) | |
Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI. NOTE: some of these details are obtained from third party information.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free