Hereta ETH‑IMC408M firmware version 1.0.15 and earlier contain a stored cross‑site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by manipulating the Device Name field. The malicious script is persisted on the device and executes automatically in any browser that displays the System Status page, enabling client‑side code execution, defacement of the UI, or hijacking of user sessions when administrators or other privileged users access the status interface.

The flaw affects the Hereta ETH‑IMC408M device from Shenzhen Hereta Technology Co., Ltd. All firmware releases 1.0.15 and earlier are vulnerable. No additional sub‑version ranges are specified.

The CVSS score of 5.1 indicates moderate severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. Attacker must first authenticate to the device’s management interface to modify the Device Name field. Once the script is stored, it runs automatically for all browsers that load the System Status page, posing significant risk to confidentiality and integrity of user sessions.