Sv Cpt Mc310
Monthly
OS command injection in Contec SolarView Compact (models SV-CPT-MC310 and SV-CPT-MC310F) allows any authenticated low-privilege user to execute arbitrary operating system commands through the Schedule Settings feature. Successful exploitation grants full control over the underlying device with high impact to confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity makes this a straightforward target for any attacker holding valid credentials.
Cross-site scripting in the Image Management component of Contec SolarView Compact (models sv-cpt-mc310 and sv-cpt-mc310f) enables authenticated attackers to inject malicious script that can trigger arbitrary OS command execution on the underlying device. Reported by JPCERT/CC (JVNVU97753461) with a Contec vendor advisory, the vulnerability chains CWE-79 XSS with a command injection pathway, making it more dangerous than its CVSS 4.0 score of 5.1 suggests. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored cross-site scripting in Contec SolarView Compact (sv-cpt-mc310 and sv-cpt-mc310f) solar power monitoring appliances affects the Schedule Settings and Mail Send Setting pages of the web management interface. An attacker who injects a malicious script into these configuration fields can cause arbitrary OS command execution when a privileged user renders the poisoned page in an authenticated session. No public exploit has been identified at time of analysis, and the vendor has issued a security advisory coordinated through JPCERT/CC under JVNVU97753461.
OS command injection in Contec SolarView Compact (models SV-CPT-MC310 and SV-CPT-MC310F) allows any authenticated low-privilege user to execute arbitrary operating system commands through the Schedule Settings feature. Successful exploitation grants full control over the underlying device with high impact to confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity makes this a straightforward target for any attacker holding valid credentials.
Cross-site scripting in the Image Management component of Contec SolarView Compact (models sv-cpt-mc310 and sv-cpt-mc310f) enables authenticated attackers to inject malicious script that can trigger arbitrary OS command execution on the underlying device. Reported by JPCERT/CC (JVNVU97753461) with a Contec vendor advisory, the vulnerability chains CWE-79 XSS with a command injection pathway, making it more dangerous than its CVSS 4.0 score of 5.1 suggests. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored cross-site scripting in Contec SolarView Compact (sv-cpt-mc310 and sv-cpt-mc310f) solar power monitoring appliances affects the Schedule Settings and Mail Send Setting pages of the web management interface. An attacker who injects a malicious script into these configuration fields can cause arbitrary OS command execution when a privileged user renders the poisoned page in an authenticated session. No public exploit has been identified at time of analysis, and the vendor has issued a security advisory coordinated through JPCERT/CC under JVNVU97753461.