CVE-2026-29521: Hereta Eth-IMC408M Firmware

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a cross-site request forgery vulnerability that allows attackers to modify device configuration by exploiting missing CSRF protections in setup.cgi. Attackers can host malicious pages that submit forged requests using automatically-included HTTP Basic Authentication credentials to add RADIUS accounts, alter network settings, or trigger diagnostics.

Affected products

• Hereta Eth-IMC408M Firmware: up to and including 1.0.15

Published 2026-03-16. Last modified 2026-06-17.