camgoering/solarview-ics-vulnerability-analysisThreat model and vulnerability analysis of Contec SolarView Compact (CVE-2022-29303)
A cyber-physical threat analysis of the SolarView Compact / Mirai botnet incident, in which attackers exploited CVE-2022-29303 to compromise roughly 800 solar monitoring appliances at Japanese photovoltaic facilities.
Course project for ECE 362 — Cyber-Physical Systems, University of Tennessee, Knoxville · Spring 2026 Team: Matthew Ferrari, Camden Reed, Camden Goering
The Contec SolarView Compact is a Linux-based data-logging appliance that sits between a solar site's inverters and the internet — it polls inverter telemetry over Modbus/RS-485 and forwards it to a vendor cloud and operator dashboards. Structurally, it is the bridge between the public internet and the OT segment of a generation facility.
CVE-2022-29303 is an unauthenticated remote command injection in the device's conf_mail.php handler, which passes an unsanitized user parameter into a shell invocation. A single HTTP POST yields code execution with no credentials required.
| CVSS v3.1 | 9.8 Critical — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Disclosure → patch | May 2022 → 18 July 2023 (~14 months) |
| Devices affected | ~800 hijacked; 600+ internet-exposed at disclosure, under one-third patched |
| Observed use | Mirai-variant botnet; DDoS-for-hire and bank-fraud proxying |
The attackers had root on 800 devices bridging the internet and solar OT networks — and used them to commit financial fraud. The access required to disrupt generation was the same access they already had.
Adversary model. Two profiles against the same vulnerability: Adversary A, financially motivated and opportunistic, treating the site as an incidentally compromised IoT host — this is what was actually observed. Adversary B, state-aligned and patient, valuing persistent quiet access to the inverter control plane for a future contingency. The threat model targets the capability, not the observed campaign.
STRIDE decomposition across the device's three trust zones (public internet, site OT network, vendor cloud) — including the repudiation finding that operators learned of the compromise from external reporting, because the devices meant to provide visibility were the compromised assets.
MITRE ATT&CK for ICS attack chain: T0819 Exploit Public-Facing Application → T0871 Execution through API → T0889 Modify Program → T0840/T0846 discovery → T0866 lateral movement. The adversary profiles diverge at Impact: T0814 Denial of Service for A, T0831 Manipulation of Control for B.
Risk assessment using CVSS v3.1 and DREAD (aggregate 8–9, driven by reproducibility and Shodan-indexable discoverability), plus a qualitative 5×5 likelihood × impact matrix placing the threat in the upper-right quadrant. Environmental rescoring raises Scope to Changed, since compromising the monitoring appliance grants access to a separate trust zone.
Defenses mapped to the NIST Cybersecurity Framework across all five functions. Highest-leverage controls: keep the device off the public internet, and enforce vendor patch SLAs contractually — the 14-month patch gap was the central failure.
The dominant risk drivers here are not exotic: unauthenticated internet exposure, slow vendor patching, and flat OT networks. Neither are the mitigations. The gap is that DER monitoring equipment has not historically been treated as critical infrastructure, despite sitting structurally between the public internet and the physical grid.
Three-person team project. I presented the vulnerability and attack-path portion of our in-class presentation, covering the CVE-2022-29303 command injection, the Shodan exposure data, and the attribution to Arsenal Depository. Contributed to revisions of the final report and to the framework analysis the paper is built on.
Palo Alto Unit 42 (Mirai campaign analysis) · VulnCheck (SolarView exploitation) · NVD CVE-2022-29303 · Forescout Vedere Labs SUN:DOWN · NIST SP 800-82r3 · MITRE ATT&CK for ICS v14 · IEEE Std 1547-2018
