JVNDB-2022-002112

CONTEC SolarView Compact vulnerable to insufficient verification in uploading files

SolarView Compact provided by CONTEC CO., LTD. is PV Measurement System.
The image file management page of SolarView Compact contains an insufficient verification vulnerability when uploadi

webray reported this vulnerability to JPCERT/CC.
JPCERT/CC coordinated with the developer.ng files (CWE-20).

Contec

• SolarView Compact SV-CPT-MC310 Ver.7.23 and earlier
• SolarView Compact SV-CPT-MC310F Ver.7.23 and earlier

Arbitrary PHP code may be executed if a remote authenticated attacker uploads a specially crafted PHP file.

[Update the firmware]
Update the firmware to the latest version according to the information provided by the developer.
This vulnerability has been already addressed in the following firmware versions.

* SolarView Compact
* SV-CPT-MC310 Ver.7.24
* SV-CPT-MC310F Ver.7.24

[Apply the workaround]
Applying the following workarounds may mitigate the impacts of this vulnerability.
* Disconnect from network if the product is used in the standalone environment
* Setup a firewall and run the product behind it
* Configure the product in the trusted and closed network
* Choose "User authentications required in all menus" under "User authentication target settings" in "User account settings"
* Change default credentials

Contec

• Contec Co., Ltd. : Regarding a vulnerability in SolarView Compact (SV-CPT-MC310) (in Japanese)
• Contec Co., Ltd. : SV-CPT-MC310 | firmware (in Japanese)

1. Improper Input Validation(CWE-20) [Other]

1. CVE-2022-35239

1. JVN : JVNVU#93696585

• [2022/08/03]
    Web page was published
• [2023/03/31]
    Overview was modified