CVE-2026-29510mediumCWE-79

CVE-2026-29510: medium-severity vulnerability in Shenzhen Hereta Technology Co., Ltd.

Hereta ETH-IMC408M Stored XSS via Device Name

Published · Updated

Follow this CVE+ Monitor Hereta ETH-IMC408M

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.1epss 0.1%
Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by manipulating the Device Name field. Attackers can inject malicious scripts through the System Status interface that execute in browsers of users viewing the status page without input sanitation.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Affected products
Shenzhen Hereta Technology Co., Ltd. · Hereta ETH-IMC408M
Related CVEs — Shenzhen Hereta Technology Co., Ltd.

In the same product, most dangerous first.

CVE-2026-29520MEDIUMHereta ETH-IMC408M Reflected XSS via ping_ipaddr ParameterEPSS 0.2%CVE-2026-29513MEDIUMHereta ETH-IMC408M Stored XSS via Device LocationEPSS 0.1%CVE-2026-29521MEDIUMHereta ETH-IMC408M CSRF via Configuration SetupEPSS 0.1%