CVE-2026-29513 MEDIUM

CVE-2026-29513: Hereta ETH-IMC408M Stored XSS via Device Location

Vendor Shenzhen Hereta Technology Co., Ltd.
Product Hereta ETH-IMC408M
Weakness CWE-79 · XSS
Published March 16, 2026
Last update March 17, 2026
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by manipulating the Device Location field. Attackers can inject malicious scripts through the System Status interface that execute in browsers of users viewing the status page without input sanitation.

Key dates

02Disclosure timeline

March 16, 2026 CVE published
March 17, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-46448 WordPress Document Management System plugin <= 1.24 - Cross Site Scripting (XSS) Vulnerability CVE-2025-32609 WordPress Verowa Connect Plugin <= 3.0.4 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2023-2402 Photo Gallery Slideshow & Masonry Tiled Gallery <= 1.0.13 - Reflected Cross-Site Scripting CVE-2026-24948 WordPress Reflector plugin <= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2026-35046 Tandoor has a Stored CSS Injection via <style> Tag in Recipe Instructions (API-Level)