Hereta ETH-IMC408M Cross-Site Request Forgery Vulnerability in Firmware through 1.0.15

A cross-site request forgery (CSRF) vulnerability has been identified in the Hereta ETH-IMC408M firmware, affecting versions through 1.0.15. This vulnerability allows attackers to modify device configurations by exploiting the absence of CSRF protections in the 'setup.cgi' file. Attackers can create malicious web pages that send forged requests, using automatically included HTTP Basic Authentication credentials, to manipulate device settings. This could include adding RADIUS accounts, changing network configurations, or initiating diagnostic processes.

Impact

Exploitation of this vulnerability could lead to unauthorized modifications of the device's configuration, potentially allowing for unauthorized access or disruption of services.