PT-2026-25783 · Shenzhen Hereta Technology Co. · Hereta Eth-Imc408M

Kazuma Matsumoto · Publicado 2026-03-16 · Atualizado 2026-03-17 · CVE-2026-29520

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Hereta ETH-IMC408M firmware versions prior to 1.0.15

Description The software contains a reflected cross-site scripting issue in the Network Diagnosis ping function. This allows attackers to execute arbitrary JavaScript. Attackers can create malicious links with script payloads injected into the ping ipaddr parameter. Successful exploitation can compromise authenticated administrator sessions when these links are visited.

Recommendations Update to a version prior to 1.0.15.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-29520

Produtos afetados

Hereta Eth-Imc408M

Referências · 4

• https://web.archive.org/web/20250820105319/http://hereta.com · Nota
• https://vulncheck.com/advisories/hereta-eth-imc408m-reflected-xss-via-ping-ipaddr-parameter · Nota
• https://twitter.com/CVEnew/status/2033755345126863162 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-29520 · Nota de Segurança