In an unsettling revelation, security experts have uncovered an actively exploited vulnerability in Contec SolarView, a popular solar power monitoring product. The discovery has raised significant concerns as it exposes hundreds of energy organizations to potential attacks. This article delves into the details of the vulnerability, its exploitation by a Mirai variant, the impacted versions, and the potential consequences for energy organizations.
Exploitation of SolarView Vulnerability by Mirai Variant
According to a report by Palo Alto Networks, a variant of the notorious Mirai malware has been exploiting the vulnerability in SolarView devices. These devices are being hacked and coerced into forming a powerful botnet. By leveraging the vulnerability, the attackers are able to gain unauthorized access and control over SolarView systems, compromising their integrity and potentially wreaking havoc on networks.
Description of CVE-2022-29303 Vulnerability
Designated as CVE-2022-29303, the vulnerability affecting SolarView version 6.0 is identified as a code injection issue. Alarmingly, this flaw can be exploited remotely by unauthenticated attackers, making it an attractive target for malicious actors. By injecting code into vulnerable SolarView systems, attackers can execute arbitrary commands, gaining unauthorized control over critical infrastructure.
Patching and Impacted Versions
VulnCheck’s analysis reveals that the security hole in Contec’s SolarView product was only patched with the release of version 8.0. Disturbingly, versions dating back to at least version 4.0 remain vulnerable to exploitation. This implies that a significant number of energy organizations may still be at risk due to delayed patching or a lack of awareness about the vulnerability.
Number of Exposed and Vulnerable SolarView Systems
A recent search on Shodan, a search engine for internet-connected devices, has revealed the alarming reality of over 600 accessible SolarView systems online. Among these, more than 400 are running vulnerable versions, making them attractive targets for attackers seeking to exploit the known vulnerability.
Potential Consequences and Impact
The impact of exploiting the SolarView vulnerability can be significant and varied, depending on the network it is integrated into. One potential consequence is the loss of view (T0829), which could impact the monitoring and control capabilities of affected SolarView systems. This disruption can lead to a loss of productivity, revenue, and even risks to essential industrial control system (ICS) resources.
Network Dependency and Impact
The severity of the exploit expands beyond individual SolarView devices to the network to which they are connected. Given their integration within energy organizations, compromising SolarView systems could enable attackers to gain a foothold within the network infrastructure. This not only jeopardizes the operation of solar power monitoring but also exposes the entire network to potential attacks on other ICS resources.
Exploit Publicity and Availability
The fact that CVE-2022-29303 has been utilized in real-world attacks does not come as a surprise, as an exploit and exploitation instructions have been publicly available since May 2022. This widespread publicity and availability of the vulnerability further amplifies the urgency for energy organizations to promptly address the issue and prioritize security measures.
Warning of Other SolarView Vulnerabilities
VulnCheck has issued a warning that there may be additional vulnerabilities in SolarView, some of which may be more recent and yet to be discovered. These undetected vulnerabilities present a continuous risk to energy organizations, heightening the need for proactive vulnerability monitoring and enhanced threat mitigation measures.
The discovered vulnerability in Contec’s SolarView product poses a significant risk to energy organizations. The exploitation of this vulnerability by a Mirai variant emphasizes the urgency for organizations to update to the latest, patched version (8.0) to mitigate potential attacks. Furthermore, continuous vulnerability monitoring and vigilant threat mitigation efforts are essential to ensuring the security and resilience of energy networks in the face of evolving cyber threats. Safeguarding the reliability and stability of solar power monitoring systems is paramount in protecting the future of renewable energy.