CVE-2023-23333: SolarView Compact downloader.php command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated remote command execution with CVSS 9.8 and near-certain EPSS exploitation likelihood makes this an urgent patch-or-isolate case.

What it is

SolarView Compact firmware through version 6.00 contains a command injection flaw in downloader.php that lets attackers bypass internal restrictions and run arbitrary commands. With a CVSS base score of 9.8 and an EPSS probability near 0.99, this is a high-urgency remote code execution issue for exposed devices.

Impact

An unauthenticated attacker can execute arbitrary commands on the device, gaining full control of confidentiality, integrity and availability. That can lead to data theft, configuration tampering or use of the device as a foothold in the network.

Attack surface

The flaw is reachable over the network through downloader.php, per the CVSS vector AV:N/AC:L/PR:N/UI:N, meaning no authentication and no user interaction are required. Any internet- or network-exposed SolarView Compact instance is directly reachable.

Exploitation

Public exploit code is referenced (GitHub and Packet Storm), and EPSS is 0.99291 at the 99.937th percentile, indicating very high likelihood of exploitation. The CVE is not listed in CISA KEV, so no confirmed in-the-wild campaign is documented in this record.

What to do

• Upgrade SolarView Compact firmware beyond version 6.00 to a vendor-fixed release; confirm the fixed version with Contec since the record does not name one.
• If patching is not immediately possible, remove internet exposure and restrict access to downloader.php to trusted management networks only.
• Place the device behind a firewall or reverse proxy that blocks untrusted access to the web interface.
• Monitor Contec advisories and apply vendor guidance as soon as a fixed firmware is available.
• Rotate any credentials or keys stored on or managed through the device if compromise is suspected.

Detection

• Inspect web server and device logs for requests to downloader.php with suspicious parameters or shell metacharacters.
• Alert on unexpected outbound connections or process execution from the SolarView device.
• Monitor for command-shell child processes spawned by the web service on the device.
• Use the public exploit references to build signatures for known downloader.php abuse patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.