CVE-2023-23333

SolarView Compact unauthenticated remote command execution vulnerability.

Severity Score

9.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through downloader.php.

SolarView Compact version 6.00 suffers from a remote command injection vulnerability.

*Credits: N/A

CVSS Scores

NISTv3.1 9.8

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2023-01-11 CVE Reserved
2023-02-06 CVE Published
2023-05-15 First Exploit
2024-08-02 CVE Updated
2024-09-13 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

CAPEC

References (8)

URL	Tag	Source
http://packetstormsecurity.com/files/174537/SolarView-Compact-6.00-Remote-Command-Execution.html
https://attackerkb.com/topics/kE3lzTZGV2/cve-2023-23333

URL	Date	SRC
https://www.exploit-db.com/exploits/51886	2024-03-14
https://github.com/emanueldosreis/nmap-CVE-2023-23333-exploit	2023-08-01
https://github.com/binaryusergearone/SolarView-Compact-6.00-Command-Injection-Exploit-CVE-2023-23333-	2024-06-22
https://github.com/Mr-xn/CVE-2023-23333	2023-06-16
https://github.com/Timorlover/CVE-2023-23333	2024-08-02
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/solarview_unauth_rce_cve_2023_23333.rb	2023-05-15

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Contec Search vendor "Contec"	Solarview Compact Firmware Search vendor "Contec" for product "Solarview Compact Firmware"	<= 6.00 Search vendor "Contec" for product "Solarview Compact Firmware" and version " <= 6.00"	-	Affected	in	Contec Search vendor "Contec"	Solarview Compact Search vendor "Contec" for product "Solarview Compact"	-	-	Safe