Officials once again warn defenders that Russian hackers are targeting network devices

Cisco IOS 12.4 contains multiple cross-site request forgery (CWE-352) flaws in the IOS HTTP management web interface that allow a remote attacker to execute arbitrary commands on the device. The flaws are triggered when an attacker induces an already-authenticated privileged (level 15) administrator's browser to send crafted HTTP requests to the router's web server, for example a "show privilege" command via the /level/15/exec/- URI or an "alias exec" configuration command via the /level/15/exec/-/configure/http URI, letting the attacker run commands with the administrator's privileges, potentially including device reconfiguration. Any Cisco IOS 12.4 device with the HTTP/HTTPS management server enabled and reachable from an administrator's browser is affected. CISA added the issue to the Known Exploited Vulnerabilities catalog on 2026-07-13, indicating known exploitation in the wild, and EPSS assigns a 33.9% probability of exploitation in the next 30 days (98th percentile); no public proof-of-concept is known and ransomware use is not confirmed.

Do: Inventory Cisco IOS devices for the 'ip http server' / 'ip http secure-server' configuration, and disable the HTTP/HTTPS management server where it is not needed or restrict it to management networks via access control lists. Apply Cisco's vendor-recommended fixed IOS release for CVE-2008-4128 in line with CISA BOD 26-04 deadlines, prioritizing internet-facing routers. Because exploitation is confirmed, also review device configurations and logs for unauthorized 'alias exec' entries or unexpected configuration changes.

CVE-2018-0171 is a critical (CVSS 9.8) buffer-overflow vulnerability in the Smart Install feature of Cisco IOS and Cisco IOS XE, caused by improper validation of packet data (CWE-20, CWE-787). An unauthenticated, remote attacker can trigger it by simply sending a crafted Smart Install message to TCP port 4786 on an affected device, with no credentials or user interaction required. A successful exploit can cause a device reload, an indefinite loop that triggers a watchdog crash, or arbitrary code execution, giving the attacker full control of the switch or router. Any IOS or IOS XE device running the Smart Install service is affected — a configuration commonly present on Catalyst switches — and devices exposed to the internet on TCP 4786 are at direct risk. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog, and both Russian (Static Tundra, FSB-linked) and Chinese (Salt Typhoon) state-sponsored actors have exploited it to compromise unpatched, often end-of-life, Cisco network devices at hundreds of organizations worldwide.

Do: Upgrade IOS/IOS XE to a fixed release per Cisco's advisory (Bug ID CSCvg76186); for end-of-life hardware that cannot be patched, plan replacement given active nation-state targeting of unpatched devices. If Smart Install is not in use, disable it with 'no vstack'; otherwise restrict TCP port 4786 with ACLs to trusted management hosts. Audit internet-facing switches and routers for Smart Install enabled and TCP 4786 exposed, and prioritize those devices for remediation.