CVE-2022-29303: SolarView Compact conf_mail.php OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote command execution with a 9.8 CVSS score, KEV listing and near-maximum EPSS makes this an urgent patch-or-remove case.

What it is

SolarView Compact version 6.00 contains an OS command injection flaw reached through conf_mail.php. An unauthenticated remote attacker can inject and execute arbitrary commands on the device, which is a critical exposure for internet-facing deployments.

Impact

An attacker gains remote command execution with the privileges of the web service, allowing full compromise of confidentiality, integrity and availability of the device. This can be used to pivot into the network the device monitors.

Attack surface

Reachable over the network via HTTP through conf_mail.php; the CVSS vector shows no privileges required and no user interaction, so it is exploitable pre-authentication.

Exploitation

It is listed in CISA KEV with a 2023-07-13 addition date, and public exploit references exist; EPSS is 0.97997 (99.9th percentile), indicating very high likelihood of exploitation activity.

What to do

• Apply the vendor update for SolarView Compact per CISA KEV required action; if no update is available, discontinue use of the product.
• Remove or block internet exposure of conf_mail.php and the device web interface; restrict access to trusted management networks only.
• Place the device behind a firewall or reverse proxy with strict allowlists and authentication where feasible.
• Monitor vendor advisories for Contec SolarView Compact and replace end-of-support units.
• Segment the device from production networks to limit lateral movement if compromised.

Detection

• Search web logs for requests to conf_mail.php with shell metacharacters (;, |, &&, $(), backticks) in parameters.
• Alert on unexpected outbound connections or process execution from the SolarView web service account.
• Monitor for known exploit payload patterns from the public Packet Storm and Google Drive references.
• Review device logs for anomalous command execution or configuration changes around mail settings.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.