CVE-2022-29303

What it actually does

CVE-2022-29303 is an unauthenticated command injection vulnerability in the SolarView Compact web interface, specifically reachable through conf_mail.php in version 6.00. Because the vulnerable CGI/PHP handler passes attacker-controlled input to operating-system commands without proper neutralization, a remote attacker can inject shell metacharacters and execute arbitrary commands on the appliance. With CVSS 9.8 and network-accessible, low-complexity, no-authentication exploit conditions, successful exploitation can result in full compromise of the device, including command execution, malware installation, configuration theft or alteration, disruption of monitoring functions, and pivoting opportunities from the appliance into adjacent networks.

Why it matters to the business

Compromise of a SolarView Compact device can disrupt solar power monitoring operations, reduce visibility into energy production, expose configuration or network information, and allow the device to be enrolled into botnets or used as an internal foothold. The vulnerability is listed in CISA KEV with a remediation deadline of 2023-08-03, has active in-the-wild exploitation, and has a very high EPSS score of 0.98039, meaning internet-exposed systems should be treated as high-probability targets even though ransomware use is not currently indicated.

How an attack unfolds

An attacker scans for internet-accessible SolarView Compact devices and identifies systems exposing the management web interface. The attacker sends a crafted HTTP request to conf_mail.php containing shell metacharacters or command-substitution syntax in a vulnerable parameter. The server-side script passes the supplied value into an operating-system command, causing the injected payload to execute with the privileges of the web application or appliance service account. Typical post-exploitation activity may include running reconnaissance commands, downloading a shell script or binary using wget, curl, tftp, or ftpget, changing permissions with chmod, executing malware, creating persistence where possible, altering device configuration, or using the device as part of a botnet or scanning infrastructure. Because exploitation is unauthenticated and has been observed in the wild, exposed devices may be compromised quickly after becoming reachable.

How to fix it

Upgrade SolarView Compact firmware to a vendor-supported version that addresses the conf_mail.php command injection issue. If no fixed version is available for the deployed model or firmware branch, contact Contec for supported remediation guidance and plan replacement or decommissioning of unsupported devices. Until remediation is complete, remove the device management interface from direct internet exposure, restrict access to trusted administrative networks or VPNs, enforce firewall allowlists, disable unused services, and monitor for suspicious outbound connections. Because the vulnerability is in the web interface and is unauthenticated, network isolation is a critical compensating control. If exploitation is suspected, perform incident response before simply upgrading: preserve logs, collect volatile evidence where possible, reimage or factory-reset using trusted firmware, rotate credentials and API/mail configuration secrets, and review adjacent network access.

How to confirm the fix worked

Confirm the deployed SolarView Compact firmware is not version 6.00 or any other vendor-confirmed vulnerable release. Validate that the management interface is not reachable from the public internet unless explicitly required and protected by strong network controls. Review web server logs for requests to /conf_mail.php containing shell metacharacters, URL-encoded command separators, or commands commonly used for payload retrieval. From a controlled security testing host, perform only non-destructive validation using vendor guidance or an approved vulnerability scanner; avoid executing arbitrary commands on production devices. Confirm compensating controls by testing that untrusted networks cannot access the web management service and that outbound egress from the appliance is limited to required destinations.

Typical attack path

1. Identify SolarView Compact devices through internet scanning, banner inspection, search engine indexing, or known management interface paths.
2. Send a crafted HTTP request to /conf_mail.php containing command-injection syntax such as semicolons, pipes, backticks, command substitution, or URL-encoded equivalents.
3. Trigger execution of arbitrary operating-system commands through the vulnerable mail configuration handler.
4. Run discovery commands to determine architecture, privileges, network connectivity, and writable directories.
5. Download and execute a second-stage payload or remote shell using utilities such as wget, curl, tftp, ftpget, busybox, sh, or chmod.
6. Establish persistence if feasible, enroll the device into botnet infrastructure, modify configuration, disrupt monitoring, or use the appliance as a foothold for additional scanning and lateral movement.

How to detect it

To determine whether exploitation already occurred, review web access logs from the SolarView Compact device, upstream reverse proxies, firewalls, IDS/IPS sensors, and network flow records. Focus on requests to /conf_mail.php, especially POST or GET requests containing shell metacharacters such as ;, |, &, `, $(), >, <, newline encodings, or their URL-encoded forms. Look for commands embedded in HTTP parameters, including wget, curl, tftp, ftpget, busybox, chmod, sh, bash, nc, telnetd, rm, uname, id, whoami, ps, kill, crontab, or attempts to write into /tmp, /var/tmp, /dev/shm, or other writable paths. Correlate suspicious web requests with outbound connections from the device to unknown IPs, newly observed DNS lookups, high-volume scanning, repeated failed outbound connections, or connections to uncommon ports. On the device, where forensic access is available, inspect process listings, startup scripts, cron entries, writable temporary directories, recently modified files, and unexpected binaries or scripts. Because embedded devices often have limited logging and attackers may remove artifacts, absence of logs does not prove absence of compromise; unexplained outbound traffic after a suspicious conf_mail.php request should be treated as a strong compromise indicator.

• /conf_mail.php
• GET /conf_mail.php
• POST /conf_mail.php
• conf_mail.php?
• conf_mail.php%3f
• %3Bwget
• ;wget
• %3Bcurl
• ;curl
• %3Btftp
• ;tftp
• %3Bftpget
• ;ftpget
• %7Cwget
• |wget
• %7Ccurl
• |curl
• %60wget
• `wget
• %24%28wget
• $(wget
• %24%28curl
• $(curl
• /bin/sh
• sh -c
• /bin/bash
• busybox
• chmod +x
• /tmp/
• /var/tmp/
• /dev/shm/
• telnetd
• nc -e
• /conf_mail.php%3B
• /conf_mail.php;
• /conf_mail.php%7C
• /conf_mail.php|
• /conf_mail.php%60
• /conf_mail.php`
• /conf_mail.php%24%28

What your security team should do

• Immediately identify all Contec SolarView Compact and SV-CPT-MC310 deployments and determine firmware versions, with priority on internet-exposed devices.
• Treat any SolarView Compact ver.6.00 system exposed to untrusted networks as potentially compromised due to active exploitation, KEV listing, and very high EPSS probability.
• Upgrade to a vendor-supported fixed firmware release where available; if no fix is available, isolate, replace, or decommission the device.
• Remove public internet access to the management interface and enforce access through VPN, jump hosts, or trusted administrative subnets only.
• Search historical web, firewall, proxy, IDS, and DNS logs for exploitation attempts against /conf_mail.php and suspicious outbound payload retrieval following those requests.
• If suspicious activity is found, preserve evidence, rebuild or factory-reset the appliance from trusted media, rotate credentials and mail/server configuration secrets, and inspect adjacent network systems for follow-on activity.
• Deploy detection rules for command-injection patterns targeting conf_mail.php, including URL-encoded shell metacharacters and payload download commands.
• Restrict appliance outbound network access to only required destinations to reduce botnet enrollment and command-and-control connectivity.
• Add the vulnerability to exposure-management and patch-governance reporting because the CISA KEV due date has passed and exploitation is active in the wild.