CVE-2026-29521

Name of the Vulnerable Software and Affected Versions Hereta ETH-IMC408M firmware versions prior to 1.0.15

Description The Hereta ETH-IMC408M firmware contains a cross-site request forgery issue that allows attackers to modify device configuration. This is due to missing Cross-Site Request Forgery (CSRF) protections in the setup.cgi file. Attackers can host malicious pages that submit forged requests using automatically-included HTTP Basic Authentication credentials. These requests can be used to add RADIUS accounts, alter network settings, or trigger diagnostics. The vulnerable component is the setup.cgi file, which lacks CSRF protections.

Recommendations Update to a version of Hereta ETH-IMC408M firmware later than 1.0.15.