Description
Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a cross-site request forgery vulnerability that allows attackers to modify device configuration by exploiting missing CSRF protections in setup.cgi. Attackers can host malicious pages that submit forged requests using automatically-included HTTP Basic Authentication credentials to add RADIUS accounts, alter network settings, or trigger diagnostics.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Shenzhen Hereta Technology | Hereta ETH-IMC408M | ≤ 1.0.15 | — |