CVE-2022-29303
SolarView Compact Command Injection Vulnerability
Description
CVE-2022-29303 is a critical command injection vulnerability in SolarView Compact ver.6.00, a solar energy monitoring system manufactured by Contec. The vulnerability exists in the conf_mail.php component, allowing an unauthenticated remote attacker to inject and execute arbitrary operating system commands on the underlying server. Successful exploitation of CVE-2022-29303 grants full control over the SolarView Compact device, compromising the confidentiality, integrity, and availability of the monitoring system. CISA has added this command injection vulnerability to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With a CVSS score of 9.8 (Critical) and an EPSS score of 94.4%, CVE-2022-29303 in SolarView Compact represents a severe security risk for organizations using this industrial monitoring equipment.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| contec | sv-cpt-mc310 firmware | 6.00 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/167183/SolarView-Compact-6.0-Command-Injection.html(Exploit, Third Party Advisory)
- https://drive.google.com/drive/folders/1tGr-WExbpfvhRg31XCoaZOFLWyt3r60g?usp=sharing(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-29303(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
OS command injection occurs when an application passes unsanitized user input directly to operating system command execution functions, allowing an attacker to inject arbitrary commands. In CVE-2022-29303, the SolarView Compact web interface's conf_mail.php endpoint fails to properly sanitize user-supplied input before incorporating it into OS commands, enabling remote attackers to execute arbitrary commands on the device.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Impact Analysis
CVE-2022-29303 is remotely exploitable without physical access, as the attack vector is network-based. The vulnerability is easy to exploit with no special conditions needed, requires no authentication, and no user interaction is necessary for successful exploitation. Confidentiality (High): An attacker can access all data on the SolarView Compact device, including solar energy monitoring data, system configurations, credentials, and potentially network information about connected industrial infrastructure. Integrity (High): With full command execution capability, the attacker can modify system configurations, alter monitoring data, install backdoors, and tamper with the device firmware. Availability (High): The attacker can shut down the monitoring system, disrupt solar energy data collection, or use the compromised device as a pivot point for further attacks against the industrial network. With a CVSS score of 9.8 (Critical severity) and an EPSS score of 94.4% in the 99.9th percentile, this vulnerability is among the most actively targeted command injection flaws in industrial equipment.
Exploit Maturity
Public exploit code is available for CVE-2022-29303 via Packet Storm Security, providing attackers with a ready-made command injection exploit for the SolarView Compact web interface. Additionally, a third-party exploit demonstration is publicly available. CISA has confirmed active exploitation of CVE-2022-29303 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of August 3, 2023. The EPSS score of 94.4% places this vulnerability in the 99.9th percentile, indicating near-certain exploitation activity and confirming that attackers are actively targeting SolarView Compact installations.
Remediation
- Apply mitigations per vendor instructions or discontinue use of the SolarView Compact ver.6.00 if mitigations are unavailable, as directed by CISA's KEV catalog guidance.
- Upgrade the SolarView Compact firmware (Contec SV-CPT-MC310) to a version that addresses the command injection vulnerability in conf_mail.php. Contact Contec/SolarView for the latest patched firmware release.
- Isolate SolarView Compact devices from the internet and general network access immediately. Place these devices behind a firewall on a dedicated OT/ICS network segment, restrict access to management interfaces to trusted administrator IP addresses only, and ensure no direct internet exposure of the web interface.
- Review system logs and check for indicators of compromise on all SolarView Compact devices. Look for unexpected commands executed through conf_mail.php, unauthorized access to the web interface, newly created user accounts, or unusual outbound network connections from the device.
- Implement input validation and command execution controls as part of a long-term hardening strategy. Where possible, deploy a web application firewall (WAF) in front of the device's web interface to filter command injection payloads, and enforce network-level access controls that limit who can reach the management interface.
Technical Details
CVE-2022-29303 is an OS command injection vulnerability (CWE-78) in the SolarView Compact ver.6.00 web interface, specifically in the conf_mail.php component. The vulnerable endpoint fails to neutralize special characters and shell metacharacters in user-supplied input before passing it to operating system command execution functions, allowing an attacker to append arbitrary commands. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects maximum exploitability: the attack is conducted remotely over the network with low complexity, requires no privileges or user interaction, and results in complete compromise of the device's confidentiality, integrity, and availability. The scope is unchanged, meaning the impact is confined to the SolarView Compact device itself, though as an industrial monitoring system it may provide a foothold into broader OT/ICS environments.
Frequently Asked Questions
Is CVE-2022-29303 being actively exploited?
Yes, CVE-2022-29303 is being actively exploited. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of August 3, 2023. Public exploit code is available on Packet Storm Security, and the EPSS score of 94.4% (99.9th percentile) confirms widespread exploitation of this SolarView Compact command injection vulnerability.
What products are affected by CVE-2022-29303?
CVE-2022-29303 affects SolarView Compact ver.6.00, manufactured by Contec (model SV-CPT-MC310). This is a solar energy monitoring system used in industrial and renewable energy environments. All installations running firmware version 6.00 or earlier are vulnerable.
How do I fix CVE-2022-29303?
Upgrade the SolarView Compact firmware to the latest patched version from Contec. If no patch is available, disconnect the device from internet-accessible networks immediately and restrict access to trusted IP addresses only. Implement network segmentation to isolate the device on a dedicated OT network segment.
How severe is CVE-2022-29303?
CVE-2022-29303 is rated Critical with a CVSS score of 9.8 out of 10, the highest severity category. The EPSS score of 94.4% places it in the 99.9th percentile of exploited vulnerabilities. The combination of trivial exploitation, no authentication requirement, and full system compromise makes this one of the most dangerous vulnerabilities in industrial monitoring equipment.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.