Key detail from CVE description: the vulnerability is a stored cross‑site scripting flaw in the Device Location field of Hereta ETH‑IMC408M firmware that allows authenticated attackers to inject arbitrary JavaScript, which is retained and executed when any user views the System Status page in a browser without input sanitation. This constitutes a CWE‑79 weakness. Based on the description, it is inferred that an attacker could use the injected script to steal session cookies, hijack user sessions, or deface the status page, but these specific impacts are not explicitly stated in the CVE description. The primary impact is stored XSS that can affect all users who view the affected page.

Shenzhen Hereta Technology Co., Ltd. produces the Hereta ETH‑IMC408M device. Firmware versions 1.0.15 and earlier are affected. No other vendors or product families are mentioned in the available data.

The CVSS score of 5.1 indicates medium severity. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting limited public exploitation. Attackers must first authenticate to the System Status interface, requiring privileged or legitimate credentials, implying the threat comes from an insider or compromised account. Because the XSS data is stored, malicious code persists on the device until removed, potentially exposing all users who later visit the status page. The overall risk is moderate; organizations should apply a patch as soon as possible.