Reflected Cross-Site Scripting Vulnerability in Hereta ETH-IMC408M Firmware
CVE-2026-29520

5.1MEDIUM

Key Information:

Vendor

Shenzhen Hereta Technology Co., Ltd.

Status
Hereta Eth-imc408m
Vendor
CVE Published:
16 March 2026

What is CVE-2026-29520?

The Hereta ETH-IMC408M firmware versions up to 1.0.15 are susceptible to a reflected cross-site scripting vulnerability, specifically in the Network Diagnosis feature's ping function. This flaw enables attackers to inject and execute arbitrary JavaScript by crafting malicious URLs containing payloads in the ping_ipaddr parameter. When an authenticated administrator interacts with such links, their session can be compromised, presenting serious security risks for the network's integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Hereta ETH-IMC408M 0 <= 1.0.15

References

https://web.archive.org/web/20250820105319/http://hereta....
product
https://www.vulncheck.com/advisories/hereta-eth-imc408m-r...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
JSON
.