Description

SolarView Compact contains a cross-site scripting vulnerability in Schedule Settings and Mail Send Setting. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-14T07:17:21.763Z",
  "pubdate": "2026-09-14T07:17:21.763Z",
  "executiveSummary": "SolarView Compact is susceptible to a critical security vulnerability involving the improper neutralization of user-supplied input within the Schedule Settings and Mail Send Setting interfaces.\nThis vulnerability is classified as an injection flaw, specifically allowing for arbitrary OS command execution rather than traditional reflected or stored Cross-Site Scripting (XSS) alone.\nThe vulnerability affects authenticated users who possess valid login credentials for the product's administrative or configuration interface.\nBy manipulating input fields associated with schedule or mail configurations, an attacker can escape the application's intended logic to execute unauthorized system-level commands with the privileges of the underlying web service.\nThe risk implication is severe, as successful exploitation results in full unauthorized control over the affected hardware, potentially leading to data exfiltration, persistent backdoors, or complete system compromise.\nExploitation requires successful authentication to the management console; however, once inside, no additional privilege escalation is required to achieve remote code execution.",
  "technicalDetails": "The vulnerability resides within the application's handling of HTTP POST requests sent to the Schedule Settings and Mail Send Setting components. The underlying software fails to adequately sanitize or validate user input parameters before passing them to system calls or shell execution contexts.\nThe root cause is identified as an improper validation of input data, which enables an attacker to inject shell metacharacters. When the product processes these configuration updates, the injected commands are interpreted and executed by the operating system shell under the context of the user running the SolarView Compact web interface.\nThe attack flow proceeds as follows: First, the attacker establishes an authenticated session with the SolarView Compact management interface. Second, the attacker navigates to the target configuration pages—specifically Schedule Settings or Mail Send Setting. Third, the attacker inputs a malicious payload containing shell commands (e.g., using command delimiters such as semicolon ';', pipe '|', or backticks '`') into the input fields intended for system parameters.\nUpon saving or applying these settings, the backend application script fails to strip or escape these metacharacters. The server-side logic constructs a command string that includes the attacker-supplied payload and executes it via a system function call. This behavior effectively transforms the configuration interface into a remote command execution vector.\nThe impact of this vulnerability is total system compromise. Since the web service typically operates with elevated permissions to modify system configuration files and services, the injected commands inherit these privileges. Post-exploitation, an attacker can modify system files, terminate services, deploy custom malware, or pivot into the internal network segment where the device is deployed.\nThe vulnerability persists due to the lack of secure coding practices in handling process-level execution, such as utilizing parameterized functions or restricted execution environments that prevent shell invocation from user-controlled strings."
}