Vulnerability Details CVE-2026-29521
Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a cross-site request forgery vulnerability that allows attackers to modify device configuration by exploiting missing CSRF protections in setup.cgi. Attackers can host malicious pages that submit forged requests using automatically-included HTTP Basic Authentication credentials to add RADIUS accounts, alter network settings, or trigger diagnostics.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 4.8%
CVSS Severity
CVSS v3 Score 4.3