Hereta Eth Imc408M
Approved changes feed: RSS · Atom
cpe:2.3:a:shenzhen_hereta_technology_co.,_ltd.:hereta_eth-imc408m:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Shenzhen Hereta Technology Co., Ltd. (cc15526d-46f1-5d1a-b2f4-21e1e39137db) |
|---|---|
| Product | Hereta Eth Imc408M (4e2229eb-f8e3-5363-a40c-1afc9caa9862) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-29521 |
vulnerable | 2026-06-08 07:55:16.247174 |
Hereta ETH-IMC408M CSRF via Configuration Setup
MEDIUM (4.3)
Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a cross-site request forgery vulnerability that allows attackers to modify device configuration by exploiting missing CSRF protections in setup.cgi. Attackers can host malicious pages that submit forged requests using automatically-included HTTP Basic Authentication credentials to add RADIUS accounts, alter network settings, or trigger diagnostics.
Published: 2026-03-16T16:55:34.505Z
Updated: 2026-03-17T15:29:46.810Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-29520 |
vulnerable | 2026-06-08 07:55:16.246651 |
Hereta ETH-IMC408M Reflected XSS via ping_ipaddr Parameter
MEDIUM (6.1)
Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a reflected cross-site scripting vulnerability in the Network Diagnosis ping function that allows attackers to execute arbitrary JavaScript. Attackers can craft malicious links with injected script payloads in the ping_ipaddr parameter to compromise authenticated administrator sessions when the links are visited.
Published: 2026-03-16T16:55:52.660Z
Updated: 2026-03-17T15:29:29.391Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-29513 |
vulnerable | 2026-06-08 07:55:16.237850 |
Hereta ETH-IMC408M Stored XSS via Device Location
MEDIUM (5.4)
Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by manipulating the Device Location field. Attackers can inject malicious scripts through the System Status interface that execute in browsers of users viewing the status page without input sanitation.
Published: 2026-03-16T16:56:06.732Z
Updated: 2026-03-17T15:29:07.351Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-29510 |
vulnerable | 2026-06-08 07:55:16.236064 |
Hereta ETH-IMC408M Stored XSS via Device Name
MEDIUM (5.4)
Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by manipulating the Device Name field. Attackers can inject malicious scripts through the System Status interface that execute in browsers of users viewing the status page without input sanitation.
Published: 2026-03-16T16:56:21.182Z
Updated: 2026-03-17T15:28:52.668Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.