CVE-2022-29298 Scanner
Targets the 'download' endpoint with crafted path traversal sequences to read arbitrary files from the server filesystem.
Short Info
Level
Single Scan
Single Scan
Can be used by
Asset Owner
Estimated Time
10 seconds
Time Interval
1 month 10 days
Scan only one
URL
Toolbox
SolarView Compact is a monitoring and management software for solar panel systems, widely used by residential and commercial solar asset owners to track energy production, efficiency, and system health. It provides real-time data and historical analytics to optimize solar panel performance.
CVE-2022-29298 is a directory traversal vulnerability that arises due to insufficient input validation in the file download functionality. Attackers can manipulate file path parameters to escape the intended directory and access sensitive files on the server.
The vulnerability specifically affects the 'download' endpoint, where the 'file' parameter is not sanitized. By injecting sequences like '../', an attacker can traverse directories and retrieve files such as configuration files, credentials, or system logs.
Successful exploitation can lead to exposure of sensitive data, including login credentials and system configurations, potentially enabling further attacks like system compromise or unauthorized control of the solar panel infrastructure.
