Hereta ETH‑IMC408M firmware version 1.0.15 and earlier are affected by a cross‑site request forgery (CSRF) vulnerability in the setup.cgi handler. The missing CSRF checks allow an attacker to host a malicious webpage that submits forged requests using the device’s automatically‑included HTTP Basic Authentication credentials. Successful exploitation can result in the creation of unauthorized RADIUS accounts, alteration of network settings, or triggering of diagnostics, effectively enabling attackers to modify configuration and potentially disrupt network services.

Shenzhen Hereta Technology Co., Ltd. product Hereta ETH‑IMC408M is vulnerable when running firmware 1.0.15 or earlier. No additional vendor or product identifiers are listed.

With a CVSS score of 5.1 this vulnerability is classified as moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a web‑based CSRF attack; an attacker only needs to persuade a user with device credentials or rely on automatic credential inclusion to load a malicious page that submits requests to setup.cgi. No network‑level authentication is required beyond the HTTP Basic auth already configured on the device. Remote exploitation is possible via any network path that allows the attacker to reach the web interface.