CVE-2026-29520: Hereta Eth-IMC408M Firmware

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a reflected cross-site scripting vulnerability in the Network Diagnosis ping function that allows attackers to execute arbitrary JavaScript. Attackers can craft malicious links with injected script payloads in the ping_ipaddr parameter to compromise authenticated administrator sessions when the links are visited.

Affected products

• Hereta Eth-IMC408M Firmware: up to and including 1.0.15

Published 2026-03-16. Last modified 2026-06-17.