Hereta ETH-IMC408M Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the Hereta ETH-IMC408M firmware versions through 1.0.15. This vulnerability resides in the Network Diagnosis ping function, where attackers can execute arbitrary JavaScript. By crafting malicious links with injected script payloads in the ping_ipaddr parameter, attackers can compromise authenticated administrator sessions when these links are accessed.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject and execute malicious scripts in the context of the user's session.