CVE-2026-29520 MEDIUM

CVE-2026-29520: Hereta ETH-IMC408M Reflected XSS via ping_ipaddr Parameter

Vendor Shenzhen Hereta Technology Co., Ltd.
Product Hereta ETH-IMC408M
Weakness CWE-79 · XSS
Published March 16, 2026
Last update March 17, 2026
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a reflected cross-site scripting vulnerability in the Network Diagnosis ping function that allows attackers to execute arbitrary JavaScript. Attackers can craft malicious links with injected script payloads in the ping_ipaddr parameter to compromise authenticated administrator sessions when the links are visited.

Key dates

02Disclosure timeline

March 16, 2026 CVE published
March 17, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-0162 CPO Companion <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2024-27300 phpMyFAQ Stored XSS at user email CVE-2026-6622 BichitroGan ISP Billing Software Customer edit cross site scripting CVE-2021-36739 XSS vulnerability in the MVCBean JSP portlet maven archetype CVE-2026-2924 Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'imageLoad'