Vulnerability · Published Aug 16, 2022 · Assigned by jpcert
CVE-2022-35239
High 8.8
In plain English
A high-severity security flaw in SolarView Compact from CONTEC CO., LTD.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).
Severity (CVSS NVD)8.8High
Exploit odds (30 days)1.5%top 25.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The image file management page of SolarView Compact SV-CPT-MC310 Ver.7.23 and earlier, and SV-CPT-MC310F Ver.7.23 and earlier contains an insufficient verification vulnerability when uploading files. If this vulnerability is exploited, arbitrary PHP code may be executed if a remote authenticated attacker uploads a specially crafted PHP file.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CONTEC CO., LTD. | SolarView Compact | SV-CPT-MC310 Ver.7.23 and earlier, and SV-CPT-MC310F Ver.7.23 and earlier |
References
- https://www.contec.com/jp/api/downloadlogger?download=/jp/-/media/Contec/jp/support/security-info/contec_security_solarview_220727.pdf x_refsource_MISC
- https://www.contec.com/jp/download/donwload-list/?itemid=b28c8b7c-9f40-40b2-843c-b5b04c035b0e#firmware x_refsource_MISC
- https://jvn.jp/en/vu/JVNVU93696585/ x_refsource_MISC