EUVD-2026-77251
GHSA-f3v2-4r73-chq5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Schedule Settings and Mail Send Setting require authentication to access (PR:L per description); XSS requires a second user to render the payload (UI:R); scope changes to browser context (S:C); OS command execution yields limited C/I per CVSS 4.0 SC:L/SI:L.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
3DescriptionCVE.org
SolarView Compact contains a cross-site scripting vulnerability in Schedule Settings and Mail Send Setting. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
AnalysisAI
Stored cross-site scripting in Contec SolarView Compact (sv-cpt-mc310 and sv-cpt-mc310f) solar power monitoring appliances affects the Schedule Settings and Mail Send Setting pages of the web management interface. An attacker who injects a malicious script into these configuration fields can cause arbitrary OS command execution when a privileged user renders the poisoned page in an authenticated session. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to the SolarView Compact web management interface (HTTP/HTTPS port). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score is 5.1, with vector AV:N/AC:L/AT:N/PR:N/UI:A - indicating network reachability without attacker privileges, but requiring user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-issued fix documented in the Contec security advisory (contec_security_sv_26091000_en.pdf), coordinated through JPCERT/CC under JVNVU97753461. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Sv Cpt Mc310
View allOS command injection in Contec SolarView Compact (models SV-CPT-MC310 and SV-CPT-MC310F) allows any authenticated low-pr
Cross-site scripting in the Image Management component of Contec SolarView Compact (models sv-cpt-mc310 and sv-cpt-mc310
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today