CVE-2026-29521 Hereta ETH-IMC408M CSRF via Configuration Setup

Medium 5.1 Published 16 Mar 2026 Updated 17 Mar 2026

Attackers can modify device configuration, including network settings and RADIUS accounts, by tricking users into visiting malicious pages.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-29521?

CVE-2026-29521 is a medium-severity vulnerability in Shenzhen Hereta Technology Co., Ltd. Hereta ETH-IMC408M, published on 16 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a cross-site request forgery vulnerability that allows attackers to modify device configuration by exploiting missing CSRF protections in setup.cgi. Attackers can host malicious pages that submit forged requests using automatically-included HTTP Basic Authentication credentials to add RADIUS accounts, alter network settings, or trigger diagnostics.

Weakness: CWE-352

Which versions are affected by CVE-2026-29521?

It affects 1 product.

Products include Hereta Eth-Imc408m Firmware.

How do I fix CVE-2026-29521?

No fix has been published for CVE-2026-29521 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-29521 being exploited?

There is no known exploitation of CVE-2026-29521 in the wild and no public exploit code.

Sources

Also known as GHSA-3cmm-8xw2-c67r.