CVE-2026-82794

SolarView Compact, an embedded gateway used to monitor solar power generation systems, contains an OS command injection flaw (CWE-78) in its Schedule Settings function. An attacker with valid login credentials to the product's web interface can inject arbitrary operating-system commands through the Schedule Settings parameters, which the device then executes. Successful exploitation gives the attacker full control of the appliance, turning it into a foothold in the energy-monitoring or OT network it sits on — reflected in the high CVSS 4.0 score of 8.7 (network vector, low privileges required). Organizations running SolarView Compact, especially units reachable from the internet or shared networks, are affected. No public proof-of-concept or confirmed in-the-wild exploitation has been reported and the flaw is not in CISA's KEV catalog, though SolarView Compact has previously been a favored target via a similar command injection flaw (CVE-2023-23333) used in botnet and ransomware campaigns.

What to do: Apply Contec's fixed firmware as soon as vendor guidance is available and verify your device version against the advisory. Because exploitation requires a valid login, remove the SolarView Compact web interface from the internet, restrict it to a VPN or management VLAN, and enforce strong unique credentials while deleting unused accounts. Audit Schedule Settings and device logs for unexplained scheduled commands or configuration changes that could indicate tampering.