⚠ Actively exploited
Added to CISA KEV on 2023-07-13. Federal agencies required to patch by 2023-08-03. Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable..

CVE-2022-29303 — OS Command Injection in Sv-cpt-mc310 Firmware

CWE-78 — OS Command InjectionCWE-77 — Command Injection10 documents9 sources
Severity
9.8CRITICALNVD
EPSS
94.4%
top 0.03%
CISA KEV
KEV
Added 2023-07-13
Due 2023-08-03
Exploit
Exploited in wild
Active exploitation observed
Affected products
1
Contec Sv-cpt-mc310 Firmware
Timeline
PublishedMay 12
KEV addedJul 13
KEV dueAug 3
CISA Required Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

Description

SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

🔴Vulnerability Details

3
GHSA
GHSA-9pf5-f78q-q36r: SolarView Compact ver↗2022-05-13
▶
CVEList
CVE-2022-29303: SolarView Compact ver↗2022-05-12
▶
VulnCheck
SolarView Compact Command Injection Vulnerability↗2022
▶

💥Exploits & PoCs

2
Exploit-DB
SolarView Compact 6.0 - OS Command Injection↗2022-05-17
▶
Nuclei
SolarView Compact 6.00 - OS Command Injection
▶

🔍Detection Rules

1
Suricata
ET EXPLOIT SolarView Compact Command Injection Inbound (CVE-2022-29303)↗2022-05-23
▶

📋Vendor Advisories

1
CISA
SolarView Compact Command Injection Vulnerability↗2023-07-13
▶

🕵️Threat Intelligence

1
Unit42
IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits↗2023-06-22
▶
CVE-2022-29303 — OS Command Injection | cvebase