Hereta ETH‑IMC408M firmware version 1.0.15 and earlier contain a reflected cross‑site scripting vulnerability (CWE‑79) in the Network Diagnosis ping function. The flaw allows an attacker to inject arbitrary JavaScript into the ping_ipaddr parameter. When an authenticated administrator visits a crafted link, the script executes within the administrator’s browser session, potentially enabling arbitrary code execution on the device or within the administrator’s context.

The vulnerability affects devices from Shenzhen Hereta Technology Co., Ltd., specifically the Hereta ETH‑IMC408M model. Firmware versions 1.0.15 and earlier are vulnerable; any unit running these versions remains susceptible until updated.

The CVSS score of 5.1 indicates moderate severity. EPSS data is unavailable and the flaw is not listed in the CISA KEV catalog, suggesting limited real‑world exploitation evidence. Exploitation requires an authenticated administrator to click a malicious link, making it a client‑side XSS scenario. If the link is visited, the exploit succeeds; otherwise the vulnerability remains dormant. Overall risk is moderate but should be mitigated promptly to prevent potential compromise of administrator sessions.