PT-2026-25784 · Shenzhen Hereta Technology Co. · Hereta Eth-Imc408M

Kazuma Matsumoto · Published 2026-03-16 · Updated 2026-03-17 · CVE-2026-29521

Mitre

CVSS v3.1

4.3

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a cross-site request forgery vulnerability that allows attackers to modify device configuration by exploiting missing CSRF protections in setup.cgi. Attackers can host malicious pages that submit forged requests using automatically-included HTTP Basic Authentication credentials to add RADIUS accounts, alter network settings, or trigger diagnostics.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-29521

Affected Products

Hereta Eth-Imc408M

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-29521 · Security Note
• https://twitter.com/CVEnew/status/2033755346078990733 · Twitter Post
• https://vulncheck.com/advisories/hereta-eth-imc408m-csrf-via-configuration-setup · Note
• https://web.archive.org/web/20250820105319/http://hereta.com · Note