cbcvebase.
CVE-2023-29919
published 2023-05-23

CVE-2023-29919: SolarView Compact <= 6.0 is vulnerable to Insecure Permissions. Any file on the server can be read or modified because texteditor.php is not restricted.

PriorityP185critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
60.22%
99.0th percentile
SolarView Compact <= 6.0 is vulnerable to Insecure Permissions. Any file on the server can be read or modified because texteditor.php is not restricted.

Affected

1 ranges
VendorProductVersion rangeFixed in
contecsolarview_compact_firmware<= 6.0—

Detection & IOCsextracted from sources · hover to see the quote

path/texteditor.php↗
commandPOST /texteditor.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded directory=%2F/etc&open=%8AJ%82%AD&r_charset=none&newfile=&editfile=%2Fhome%2Fcontec%2Fdata%2FoutputCtrl%2Fremote%2F2016%2F
otherhttp.html:"SolarView Compact"
  • →Match HTTP response body for 'action="texteditor.php"', 'adduser.conf', and 'deluser.conf' simultaneously to confirm successful unauthenticated LFI exploitation via texteditor.php
  • →Detect unauthenticated POST requests to /texteditor.php with URL-encoded path traversal parameters (directory=%2F/etc) as an indicator of CVE-2023-29919 exploitation attempts
  • →Use Shodan query 'http.html:"SolarView Compact"' or 'cpe:"cpe:2.3:h:contec:solarview_compact"' to identify exposed vulnerable devices on the internet
  • ·The vulnerability affects SolarView Compact versions 6.00 and below; the path /texteditor.php is the sole unauthenticated attack surface described ↗
  • ·Both read and write (modify) operations are possible via texteditor.php, making this an integrity risk in addition to a confidentiality risk ↗

CVSS provenance

nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vulncheck9.1CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.