PT-2026-25783 · Shenzhen Hereta Technology Co. · Hereta Eth-Imc408M

Kazuma Matsumoto · Published 2026-03-16 · Updated 2026-03-17 · CVE-2026-29520

Mitre

CVSS v3.1

6.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a reflected cross-site scripting vulnerability in the Network Diagnosis ping function that allows attackers to execute arbitrary JavaScript. Attackers can craft malicious links with injected script payloads in the ping ipaddr parameter to compromise authenticated administrator sessions when the links are visited.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-29520

Affected Products

Hereta Eth-Imc408M

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-29520 · Security Note
• https://web.archive.org/web/20250820105319/http://hereta.com · Note
• https://vulncheck.com/advisories/hereta-eth-imc408m-reflected-xss-via-ping-ipaddr-parameter · Note
• https://twitter.com/CVEnew/status/2033755345126863162 · Twitter Post