CVE-2023-29919: SolarView Compact texteditor.php insecure permissions allow arbitrary file read and write

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.1 with no authentication or user interaction required, a public exploit, and very high EPSS make this an urgent exposure for internet-reachable SolarView Compact devices.

What it is

SolarView Compact firmware version 6.0 and earlier exposes texteditor.php without proper permission restrictions, letting any file on the server be read or modified. Because the endpoint is reachable over the network with no authentication, an attacker can tamper with firmware or configuration files or exfiltrate sensitive data. The flaw is a CWE-276 incorrect default permissions issue.

Impact

An attacker gains full read and write access to arbitrary files on the device, enabling configuration tampering, credential or data theft, and potential code execution through modified files. Integrity and confidentiality are both fully compromised; availability is not directly affected per the CVSS vector.

Attack surface

Reachable over the network via HTTP through texteditor.php; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required. Any host that can reach the device's web interface can attempt exploitation.

Exploitation

A public exploit reference exists on GitHub, and EPSS is 0.60 (99th percentile), indicating high likelihood of exploitation activity. The CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is documented in this record.

What to do

• Apply the vendor's patched firmware for SolarView Compact if available; version 6.0 and earlier are affected.
• Restrict network access to the device web interface using firewall rules or VLAN segmentation so only trusted management hosts can reach it.
• Disable or remove texteditor.php if it is not required for operations.
• Enforce authentication and authorization on all administrative endpoints and audit file permissions on the device.
• Monitor the device for unauthorized file changes and replace end-of-life units that no longer receive firmware updates.

Detection

• Monitor HTTP requests to texteditor.php, especially POST or PUT requests with file path parameters, in web server or proxy logs.
• Alert on unexpected changes to configuration or firmware files on SolarView Compact devices via file integrity monitoring.
• Watch for outbound connections or data transfers from the device to unknown hosts that could indicate file exfiltration.
• Correlate access to texteditor.php from IP addresses outside the normal management network.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.