CVE-2022-29303: SolarView Compact unauthenticated command injection, actively exploited
The short version: SolarView Compact (Contec's solar-power monitoring device) version 6.00 has a command-injection flaw (CVE-2022-29303) in conf_mail.php that lets a remote, unauthenticated attacker run operating-system commands on the device. It scores 9.8, it's been swept up by botnets like Mirai, and it's in CISA's KEV catalog. These are internet-connected field devices that rarely get touched — which is exactly why they get owned. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 97.96% · 99.9th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation due 2023-08-03 (added 2023-07-13) |
| Known exploited? | Yes — used by botnets (including Mirai variants) |
| Vulnerability type | CWE-78 OS command injection → unauthenticated remote command execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | SolarView Compact 6.00 (Contec SV-CPT-MC310) |
| Fixed in | Later firmware (> 6.00) per Contec; if none is available for your unit, discontinue exposure |
What you need to know
SolarView Compact is a monitoring appliance for photovoltaic installations — the sort of embedded device that gets bolted onto a network and forgotten. The conf_mail.php script passes user-supplied input into an OS command without sanitizing it, so an attacker who posts a crafted mail_address value (with a shell metacharacter and a command) has that command executed on the device — the classic proof being the contents of /etc/passwd echoed back.
- It's pre-authentication and trivially automatable. One crafted POST request; no credentials, no user interaction. Public exploit code exists.
- It's an embedded field device. Firmware updates are rare, monitoring is thin, and these units are meant to be reachable — a combination botnets love.
- It's already operational. The flaw has been folded into commodity botnet toolkits.
How serious we see it
High — the 9.8 is earned.
Unauthenticated remote command execution on an internet-connected device, with public exploits, active botnet use, and KEV listing, is top-of-queue. The extra wrinkle is the device class: embedded gear like this is easy to overlook in an asset inventory and hard to patch on a schedule, so vulnerable units linger. The bounded, reassuring part is that the answer is decisive — update the firmware where a fix exists, and where it doesn't, take the device off any internet-reachable path.
Recommendations
Straight from CISA's guidance and the device class realities:
- Update the firmware. Apply Contec's fixed firmware (beyond 6.00) if available for your unit.
- If no fix exists, pull it off the internet. Place SolarView behind a firewall/VPN so it isn't directly reachable; never expose the web interface publicly.
- Hunt for compromise. Given botnet use, check for unexpected processes, outbound connections, and signs of device conscription around the exposure window.
- If compromised, reset the device. Reflash/factory-reset, then re-deploy on a segmented, non-exposed network.
- Confirm your exposure first. Verify whether any SolarView Compact device is internet-facing and which firmware it runs.
How BreachRisk sees it
BreachRisk discovers internet-facing SolarView Compact interfaces from little more than your domain, fingerprints the device, and flags exposure tied to this KEV-listed, actively exploited flaw — raised to the top of your results because it's in KEV. Where testing is authorized, BreachRisk can safely confirm whether the injection point responds as vulnerable — a bounded check rather than a payload drop — turning "there's a SolarView on the internet" into a verified finding.
That outside-in view is exactly what embedded field devices need: they're easy to forget and easy to exploit, so having them mapped and prioritized is often the difference between patching a monitor and cleaning up a botnet node.