EUVD-2026-77250
GHSA-66xm-m3f9-w5fh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable command injection requiring only a valid login (PR:L); impact confined to the device with no scope change.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
4DescriptionCVE.org
SolarView Compact contains an OS command Injection vulnerability in in Schedule Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
AnalysisAI
OS command injection in Contec SolarView Compact (models SV-CPT-MC310 and SV-CPT-MC310F) allows any authenticated low-privilege user to execute arbitrary operating system commands through the Schedule Settings feature. Successful exploitation grants full control over the underlying device with high impact to confidentiality, integrity, and availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to authenticate to the SolarView Compact web management interface with at least low-privilege credentials (PR:L confirmed by CVSS 4.0 vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H correctly characterizes this as a severe, network-exploitable vulnerability requiring no special preconditions beyond valid credentials, with full device compromise as the outcome. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the firmware update for SolarView Compact as documented in the Contec security advisory (https://www.contec.com/api/downloadlogger?download=/-/media/Contec/support/security-info/2026/contec_security_sv_26091000_en.pdf) and the JVN disclosure (https://jvn.jp/en/vu/JVNVU97753461/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit and restrict Schedule Settings access on all affected SolarView Compact devices to administrative accounts only, and enable comprehensive logging of all Schedule Settings modifications. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Sv Cpt Mc310
View allCross-site scripting in the Image Management component of Contec SolarView Compact (models sv-cpt-mc310 and sv-cpt-mc310
Stored cross-site scripting in Contec SolarView Compact (sv-cpt-mc310 and sv-cpt-mc310f) solar power monitoring applianc
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today