CVE-2026-29510
Received Received - Intake

Stored XSS in Hereta ETH-IMC408M Firmware Device Name Field

Publication date: 2026-03-16

Last updated on: 2026-04-10

Assigner: VulnCheck

Description
Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by manipulating the Device Name field. Attackers can inject malicious scripts through the System Status interface that execute in browsers of users viewing the status page without input sanitation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-03-16
Last Modified
2026-04-10
Generated
2026-07-06
AI Q&A
2026-03-16
EPSS Evaluated
2026-07-05
NVD
CVE-2026-29510
EUVD
EUVD-2026-12458

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hereta eth-imc408m_firmware to 1.0.15 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in Hereta ETH-IMC408M firmware version 1.0.15 and earlier. It is a stored cross-site scripting (XSS) flaw that allows authenticated attackers to inject arbitrary JavaScript code by manipulating the Device Name field.

The malicious script is stored and then executed in the browsers of users who view the System Status interface, because the input is not properly sanitized.

Impact Analysis

An attacker who is authenticated can inject malicious JavaScript that executes in the browsers of users viewing the System Status page.

  • This can lead to theft of session cookies or credentials.
  • It may allow attackers to perform actions on behalf of the user.
  • It can result in unauthorized access or manipulation of user data.
Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-29510. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart