What is CVE-2026-29513?

CVE-2026-29513 is a medium-severity vulnerability in Hereta Eth-Imc408m, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2026-03-16.

How severe is CVE-2026-29513?

Medium severity. CVSS v3 base score is 5.4 out of 10.

XSS in Hereta Eth-Imc408m

CVE-2026-29513

Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by manipulating the Device Location field. Attackers can inject malicious scripts through the System Status interface that execute in browsers of users viewing the status page without input sanitation.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.001 (3.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

Hereta Eth-imc408m
Hereta Eth-imc408m_firmware
Shenzhen Hereta Technology Co., Ltd. Eth-imc408m — versions 0

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

disclosure@vulncheck.com (Product, product)
disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2026-29513?: CVE-2026-29513 is a medium-severity vulnerability in Hereta Eth-Imc408m, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2026-03-16.
How severe is CVE-2026-29513?: Medium severity. CVSS v3 base score is 5.4 out of 10.