Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: Shenzhen Hereta Technology Co., Ltd. Component: Eth-imc408m Firmware Clear all filters
TI-2026-23328 CVE-2026-29510 · GHSA-hr6v-99c2-7wjq

Hereta ETH-IMC408M Stored XSS via Device Name

Priority LOW 22

Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by manipulating the Device Name field.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00147 Published 2026-03-16 No fix listed CWE-79
TI-2026-23329 CVE-2026-29513 · GHSA-6j3c-vgxc-c428

Hereta ETH-IMC408M Stored XSS via Device Location

Priority LOW 22

Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by manipulating the Device Location field.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00147 Published 2026-03-16 No fix listed CWE-79
TI-2026-23335 CVE-2026-29520 · GHSA-ffrp-x6rj-x2h2

Hereta ETH-IMC408M Reflected XSS via ping_ipaddr Parameter

Priority LOW 22

Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a reflected cross-site scripting vulnerability in the Network Diagnosis ping function that allows attackers to execute arbitrary JavaScript.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00164 Published 2026-03-16 No fix listed CWE-79
TI-2026-23336 CVE-2026-29521 · GHSA-3cmm-8xw2-c67r

Hereta ETH-IMC408M CSRF via Configuration Setup

Priority LOW 28

Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a cross-site request forgery vulnerability that allows attackers to modify device configuration by exploiting missing CSRF protections in setup.cgi.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00117 Published 2026-03-16 No fix listed CWE-352