https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-29521.htmlhttps://patchthecve.com/cve/CVE-2026-29521.htmlWed, 17 Jun 2026 10:29:48 +0000MEDIUM 4.3: Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a cross-site request forgery vulnerability that allows attackers to modify device configuration by exploiting missing CSRF protections in setup.cgi. Attackers can host malicious pages that submit forged requests using automatically-includehttps://patchthecve.com/cve/CVE-2026-29520.htmlhttps://patchthecve.com/cve/CVE-2026-29520.htmlWed, 17 Jun 2026 10:29:48 +0000MEDIUM 6.1: Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a reflected cross-site scripting vulnerability in the Network Diagnosis ping function that allows attackers to execute arbitrary JavaScript. Attackers can craft malicious links with injected script payloads in the ping_ipaddr parameter to https://patchthecve.com/cve/CVE-2026-29513.htmlhttps://patchthecve.com/cve/CVE-2026-29513.htmlWed, 17 Jun 2026 10:29:47 +0000MEDIUM 5.4: Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by manipulating the Device Location field. Attackers can inject malicious scripts through the System Status interface that execuhttps://patchthecve.com/cve/CVE-2026-29510.htmlhttps://patchthecve.com/cve/CVE-2026-29510.htmlWed, 17 Jun 2026 10:29:47 +0000MEDIUM 5.4: Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by manipulating the Device Name field. Attackers can inject malicious scripts through the System Status interface that execute i