Read the docs

Shenzhen Hereta Technology Co., Ltd.

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

Shenzhen Hereta Technology Co., Ltd. records in CISA KEV

No Shenzhen Hereta Technology Co., Ltd. vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Eth-imc408m Firmware 4 records LOW

Records

4 records

TI-2026-23336 CVE-2026-29521 · GHSA-3cmm-8xw2-c67r

Hereta ETH-IMC408M CSRF via Configuration Setup

Priority LOW 28

Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a cross-site request forgery vulnerability that allows attackers to modify device configuration by exploiting missing CSRF protections in setup.cgi.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00117 Published 2026-03-16 No fix listed CWE-352
TI-2026-23335 CVE-2026-29520 · GHSA-ffrp-x6rj-x2h2

Hereta ETH-IMC408M Reflected XSS via ping_ipaddr Parameter

Priority LOW 22

Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a reflected cross-site scripting vulnerability in the Network Diagnosis ping function that allows attackers to execute arbitrary JavaScript.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00164 Published 2026-03-16 No fix listed CWE-79
TI-2026-23329 CVE-2026-29513 · GHSA-6j3c-vgxc-c428

Hereta ETH-IMC408M Stored XSS via Device Location

Priority LOW 22

Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by manipulating the Device Location field.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00147 Published 2026-03-16 No fix listed CWE-79
TI-2026-23328 CVE-2026-29510 · GHSA-hr6v-99c2-7wjq

Hereta ETH-IMC408M Stored XSS via Device Name

Priority LOW 22

Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by manipulating the Device Name field.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00147 Published 2026-03-16 No fix listed CWE-79
Open these records in search →