Hereta ETH‑IMC408M firmware versions 1.0.15 and earlier expose a reflected cross‑site scripting flaw in the network diagnosis ping feature. Attackers can embed arbitrary JavaScript into the ping_ipaddr field, causing the script to run in the context of any administrator who visits the crafted link. If an administrator executes the link, the attacker can steal session cookies, capture credentials, or perform other malicious actions on the device.

The vulnerability affects Shenzhen Hereta Technology Co., Ltd. devices running the ETH‑IMC408M hardware with firmware version 1.0.15 or earlier. These units are used in enterprise networking environments.

The issue scores a moderate CVSS of 5.1 and an EPSS below 1 %, indicating limited likelihood of widespread exploitation. The flaw is not listed in CISA’s KEV catalog. Attackers need to place the malicious URL in front of an authenticated administrator or rely on social engineering to get the link clicked. Once executed, the injected code runs with the privileges of the affected user, enabling theft of credentials and further compromise of the network management system.