Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-29521

Hereta ETH-IMC408M CSRF via Configuration Setup

Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a cross-site request forgery vulnerability that allows attackers to modify device configuration by exploiting missing CSRF protections in setup.cgi. Attackers can host malicious pages that submit forged requests using automatically-included HTTP Basic Authentication credentials to add RADIUS accounts, alter network settings, or trigger diagnostics.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Hereta Shenzhen Hereta Technology
Products
Eth-imc408m Eth-imc408m Firmware Hereta Eth-imc408m
CVE-2026-29520

Hereta ETH-IMC408M Reflected XSS via ping_ipaddr Parameter

Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a reflected cross-site scripting vulnerability in the Network Diagnosis ping function that allows attackers to execute arbitrary JavaScript. Attackers can craft malicious links with injected script payloads in the ping_ipaddr parameter to compromise authenticated administrator sessions when the links are visited.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Hereta Shenzhen Hereta Technology
Products
Eth-imc408m Eth-imc408m Firmware Hereta Eth-imc408m
CVE-2026-29513

Hereta ETH-IMC408M Stored XSS via Device Location

Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by manipulating the Device Location field. Attackers can inject malicious scripts through the System Status interface that execute in browsers of users viewing the status page without input sanitation.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Hereta Shenzhen Hereta Technology
Products
Eth-imc408m Eth-imc408m Firmware Hereta Eth-imc408m
CVE-2026-29510

Hereta ETH-IMC408M Stored XSS via Device Name

Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by manipulating the Device Name field. Attackers can inject malicious scripts through the System Status interface that execute in browsers of users viewing the status page without input sanitation.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Hereta Shenzhen Hereta Technology
Products
Eth-imc408m Eth-imc408m Firmware Hereta Eth-imc408m