← Vulnerability feed

Vulnerability record · CVE-2021-20659 · published 24 February 2021

CVE-2021-20659: Contec sv-cpt-mc310 firmware unrestricted file upload vulnerability

Contec · Sv Cpt Mc310 Firmware

SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an authenticated attacker to upload arbitrary files via unspecified vectors. If the file is PHP script, an attacker may execute arbitrary code.

8.8 CVSS 3.1 High EPSS 2.1% · top 18.8% CWE-434 · Unrestricted file upload
8.8CVSS 3.1 base score, v2 6.5
2.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an authenticated attacker to upload arbitrary files via unspecified vectors. If the file is PHP script, an attacker may execute arbitrary code.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://jvn.jp/en/jp/JVN37417423/index.html Third Party Advisory
https://www.contec.com/jp/api/downloadlogger?download=https://www.contec.com/jp/-/media/contec/jp/support/security-info/ Vendor Advisory
https://www.contec.com/jp/download/contract/contract2/?itemid=b28c8b7c-9f40-40b2-843c-b5b04c035b0e&downloaditemid=fa248f Vendor Advisory
https://jvn.jp/en/jp/JVN37417423/index.html Third Party Advisory
https://www.contec.com/jp/api/downloadlogger?download=https://www.contec.com/jp/-/media/contec/jp/support/security-info/ Vendor Advisory
https://www.contec.com/jp/download/contract/contract2/?itemid=b28c8b7c-9f40-40b2-843c-b5b04c035b0e&downloaditemid=fa248f Vendor Advisory

Track CVE-2021-20659 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-29303SolarView Compact conf_mail.php OS command injectionSolarView Compact version 6.00 contains an OS command injection flaw reached through conf_mail.php. An unauthenticated remote attacker can inject and…KEVEPSS 98%analysed9.8CVE-2022-31374Contec sv-cpt-mc310 firmware unrestricted file upload vulnerabilityAn arbitrary file upload vulnerability /images/background/1.php in of SolarView Compact 6.0 allows attackers to execute arbitrary code via a crafted …EPSS 2.4%9.8CVE-2021-20658Contec sv-cpt-mc310 firmware os command injection vulnerabilitySolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to execute arbitrary OS commands with the web server privilege via unspecified vec…EPSS 3.7%8.8CVE-2023-27514Contec sv-cpt-mc310f firmware os command injection vulnerabilityOS command injection vulnerability in the download page of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F versions prior…EPSS 1.9%8.8CVE-2023-27518Contec sv-cpt-mc310f firmware classic buffer overflow vulnerabilityBuffer overflow vulnerability in the multiple setting pages of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F versions p…EPSS 1.5%8.8CVE-2023-27521Contec sv-cpt-mc310f firmware os command injection vulnerabilityOS command injection vulnerability in the mail setting page of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F versions p…EPSS 1.9%8.8CVE-2022-35239Contec sv-cpt-mc310f firmware improper input validation vulnerabilityThe image file management page of SolarView Compact SV-CPT-MC310 Ver.7.23 and earlier, and SV-CPT-MC310F Ver.7.23 and earlier contains an insufficien…EPSS 1.4%8.1CVE-2021-20661Contec sv-cpt-mc310 firmware path traversal vulnerabilityDirectory traversal vulnerability in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows authenticated attackers to delete arbitrary files and/or …EPSS 2.5%

Source: NIST National Vulnerability Database (record CVE-2021-20659), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.