CVE-2023-40924
Published: 08 September 2023
Summary
CVE-2023-40924 is a high-severity Path Traversal (CWE-22) vulnerability in Contec Solarview Compact Firmware. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 1.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
SolarView Compact versions prior to 6.00 are affected by a directory traversal vulnerability, identified as CVE-2023-40924 and mapped to CWE-22. The issue received a CVSS 3.1 base score of 7.5, driven by an attack vector that is network-accessible, requires no authentication or user interaction, and yields high confidentiality impact while leaving integrity and availability untouched.
Remote unauthenticated attackers can exploit the flaw to traverse directories and retrieve arbitrary files from the underlying system, enabling disclosure of sensitive configuration or operational data stored on the device. The associated EPSS score has held steady at its peak value of 0.6874 with no material upward movement after the September 2023 disclosure.
The listed references consist of GitHub proof-of-concept material and NVD entries but supply no explicit mitigation guidance or patch information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-45463
Vulnerability details
SolarView Compact < 6.00 is vulnerable to Directory Traversal.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.