Hereta ETH‑IMC408M firmware versions 1.0.15 and earlier have a stored cross‑site scripting flaw in the Device Name field of the System Status interface. The vulnerability allows authenticated attackers to inject arbitrary JavaScript that is stored and later executed in the browsers of users who view the status page. The script runs with the privileges of the page viewer because no input sanitization is performed.

The affected device is the Hereta ETH‑IMC408M network unit from Shenzhen Hereta Technology Co., Ltd. Firmware version 1.0.15 and prior are impacted; no information is given about newer firmware releases, so their status is unknown.

The CVSS base score of 5.1 indicates moderate severity, while an EPSS score of less than 1 % points to a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Exploitation requires that the attacker first obtain authenticated access to the device, after which the attacker can modify the Device Name field to embed malicious JavaScript. Any user who visits the affected status page will have the script executed in their browser, potentially exposing data visible to that browser session.